CVE-2026-63205 Zammad: Channel admins can read unauthorized attachments via signature rich-text body
Channel admins can read unauthorized ticket attachments by referencing them in email signature HTML, bypassing access controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63205?
CVE-2026-63205 is a medium-severity missing authorization vulnerability in zammad, published on 25 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies that attachment into a new signature-owned record, without checking whether the user has permission to access the original attachment. The newly created copy is then downloadable by the same channel-admin user, because attachment access is determined by the copy's owner (the signature), not the original object (e.g., a ticket or knowledge-base article). This allows a user with any of the admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions to read attachments they would otherwise be denied access to, such as ticket attachments belonging to groups they are not a member of. This issue is fixed in version 7.1.2.
Which versions are affected by CVE-2026-63205?
How do I fix CVE-2026-63205?
No fix has been published for CVE-2026-63205 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-63205 being exploited?
There is no known exploitation of CVE-2026-63205 in the wild and no public exploit code.
Sources
Also known as GHSA-pp8r-x7pp-5qj5.