CVE-2026-102345

    Dashboard / Vulnerabilities / CVE-2026-102345

    CVE-2026-102345

    Published: 4 Nov 2026Last Modified: 5 Nov 2026

    Summary: Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

    Details: Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102345.json, https://github.com/zammad/zammad/security/advisories/GHSA-4x3x-65c5-8hx4, https://nvd.nist.gov/vuln/detail/CVE-2026-102345, https://github.com/zammad/zammad/commit/fe8fb9bd6c61f9136c93ef00cc08904bca0edecc

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7195a4a3e3ba9e801b6ad93f191ae423ed573d15

    Affected versions

    7.1.1
    7.1.0
    7.1.0-alpha

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-102345 | CVE-DB