The vulnerability exists in Zammad's ticket creation flow before version 7.0.1. A low‑privileged authenticated user can insert arbitrary HTML, including JavaScript event handlers, into the ticket title field. The title is stored without sanitization, meaning the malicious code will be rendered when any user views the ticket. The flaw is a classic cross‑site scripting attack (CWE‑79) that allows execution of client‑side scripts in the browser of any viewer of the affected ticket.

The issue affects all installations of Zammad running a version older than 7.0.1. Any user that has a local copy of Zammad or an instance deployed through service hosts is potentially affected until the update is applied.

The CVSS score of 8.4 classifies the vulnerability as high severity. The EPSS score is not provided, so we cannot gauge current exploit frequency, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with low privileges, but once the title is stored the malicious script can affect any subsequent viewer of the ticket. The impact is client‑side script execution.