A vulnerability in Zammad’s new Vue-based ticket interface allows an authenticated user to embed unchecked markup in a ticket article. When another user views the same ticket, the markup is rendered without the expected output encoding, resulting in stored cross‑site scripting. The weakness can enable a malicious actor to inject JavaScript that executes in the victim’s browser, potentially allowing session hijacking, defacement, or credential theft. This is a typical example of CWE‑79 (Cross‑Site Scripting) combined with CWE‑116 (Improper Encoding or Escaping).

The affected product is Zammad, an open‑source helpdesk system. All deployments of Zammad before version 7.1.2 that employ the new Vue-based ticket interface are impacted. Versions 7.1.2 and later contain the remediation. The classic REST/CoffeeScript interface remains unaffected.

The CVSS score for this issue is 5.1, indicating moderate severity. The EPSS score is not available, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The required attacker capability is moderate: the adversary must be authenticated with a user account that has permission to create or edit ticket articles. Once the payload is stored, any other authenticated user who views the ticket will be exposed. Because the default Content Security Policy limits script execution, the practical impact is mitigated, but an attacker could still exploit weaker or misconfigured CSP settings.