Zammad: Sensitive Information Exposure in Integration Administration API
Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.
CVE-2026-63207
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63207
zammad
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "zammad",
"product": "zammad",
"versions": [
{
"status": "affected",
"version": "< 7.1.2"
}
]
}
]- Related CVEs
- CVE-2026-63207
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #3900 · Revision 1
- Added to Heist Feed
- Publisher date