Zammad, the open‑source helpdesk platform, processes inline images in email signatures. Prior to version 7.1.2, any referenced attachment is copied into a new signature record without verifying the user’s rights to the original file. The copy becomes downloadable by the channel‑admin creating or updating the signature, thereby exposing attachments that the admin would normally be denied access to, such as those attached to tickets in unshared groups.

Installations of Zammad before version 7.1.2 that grant users the admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions are impacted. These users can create or modify signatures that include HTML img tags pointing to attachments owned by other groups.

The CVSS score of 5.1 indicates a moderate impact. Since the vulnerability involves creating or updating signatures through the web interface, it is inferred that the attack vector is internal via the web interface. No EPSS data is available, and the vulnerability is not listed in CISA KEV. Exploitation requires only the ability to create or update a signature, a privilege normally held by channel admins. By embedding image references in a signature, an attacker can read otherwise restricted attachments.