Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M

CVE-2026-63207Zammad: Sensitive Information Exposure in Integration Administration API

Medium 6.9

In plain English

A medium-severity information exposure in zammad from zammad. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.

Affected products (as reported)

Vendor	Product	Versions
zammad	zammad	< 7.1.2

Weakness: CWE-200, CWE-312, CWE-522 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/zammad/zammad/security/advisories/GHSA-48h2-wv8r-fgp9 x_refsource_CONFIRM
https://github.com/zammad/zammad/commit/fab2e2e9dac97b298d2c0f84b526aae2b1e6afab x_refsource_MISC