CVE-2026-63207CWE-200CWE-312CWE-522information-disclosure

CVE-2026-63207

published September 25, 2026

CVSS
6.9
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00172 · 6.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-312 · Cleartext Storage of Sensitive Information; CWE-522 · Insufficiently Protected Credentials
Published
2026-09-25T23:17Z
References (2)
https://github.com/zammad/zammad/commit/fab2e2e9dac97b298d2c0f84b526aae2b1e6afab · [email protected]https://github.com/zammad/zammad/security/advisories/GHSA-48h2-wv8r-fgp9 · [email protected]
EPSS history
Timeline
  • 27 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 25 SEP 18:20Z
    Zammad: Sensitive Information Exposure in Integration Administration API
    cvelistv5