CVE-2026-56732

5.3 Moyenne

Publiée le 25/09/2026 à 20:17 · Modifiée le 28/09/2026 à 16:45 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2.

Traduire en français

Produits concernés

zammad

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-20
CWE-352

Références

https://github.com/zammad/zammad/commit/3f6e8a5fa34eb0ce40f63292cf744f5f2992c9d0
https://github.com/zammad/zammad/releases/tag/7.0.2
https://github.com/zammad/zammad/security/advisories/GHSA-6rmm-28j9-q99q

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories