CVE-2026-63205

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2

Description When creating or updating an email signature, the system processes inline images in the signature body. If an HTML img tag points to an existing attachment, the system copies that attachment into a new record owned by the signature without verifying if the user has permission to access the original file. Since access to the copy is determined by the signature's owner rather than the original object, users with admin.channel email, admin.channel google, admin.channel microsoft365, or admin.channel microsoft graph permissions can download attachments they are not authorized to view, such as ticket attachments from groups they do not belong to.

Recommendations Update to version 7.1.2.