CVE-2026-63207 Zammad: Sensitive Information Exposure in Integration Administration API
An authenticated administrator can retrieve stored integration credentials in cleartext via the API due to inconsistent masking of sensitive fields.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63207?
CVE-2026-63207 is a medium-severity vulnerability in zammad, published on 25 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.
Which versions are affected by CVE-2026-63207?
How do I fix CVE-2026-63207?
No fix has been published for CVE-2026-63207 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-63207 being exploited?
There is no known exploitation of CVE-2026-63207 in the wild and no public exploit code.
Sources
Also known as GHSA-48h2-wv8r-fgp9.