PT-2026-99082 · Zammad · Zammad
CVE-2026-63207
·
Published
2026-09-25
·
Updated
2026-09-25
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Zammad versions 7.0.3 through 7.1.1
Description
An authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. The system fails to consistently mask sensitive fields in certain responses, allowing configured secrets for LDAP and Exchange integrations to be returned in plain text instead of the expected masked placeholder.
Recommendations
Update to version 7.1.2.
Exploit
Fix
Cleartext Storage of Sensitive Information
Information Disclosure
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zammad