{"id":"CVE-2026-56732","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-56732","generatedAt":"2026-10-28T02:19:53.546Z","title":"Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies.","description":"Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating the viewer's session. This vulnerability is fixed in 7.0.2.","published":"2026-09-25T18:17:27.000Z","lastModified":"2026-09-28T14:45:40.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-20","CWE-352"],"affected":[],"epss":{"score":0.00198,"percentile":0.09501,"date":"2026-10-26","history":[{"date":"2026-09-26","score":0.00198,"percentile":0.08649}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-25T18:17:27.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-09-25T18:17:27.370Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/zammad/zammad/commit/3f6e8a5fa34eb0ce40f63292cf744f5f2992c9d0","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/releases/tag/7.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-6rmm-28j9-q99q","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-56732","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}