The vulnerability lies in Zammad's HTML sanitizer, which blocks remote images in ticket articles and email views. By omitting the double slash after the scheme in a shortened URL, an attacker can embed a remote image that browsers interpret as an external resource. When a recipient opens a ticket or email containing such an image, the browser silently requests the image from the external server, revealing that and when the ticket was opened. The impact is a privacy leakage that can expose usage patterns to an external observer, aligning with the CWE‑184 "Redirection of User-Generated Content" and CWE‑20 "Improper Input Validation" weaknesses.

The affected product is Zammad, a web‑based open‑source helpdesk system. Versions prior to 7.1.2 are vulnerable. The issue is fixed in Zammad 7.1.2 and later.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a crafted email or ticket containing a shortened URL that bypasses the sanitizer. The attack requires the recipient to load the content in a web‑based interface, so user interaction is needed, but modern browsers treat the shortened form as an equivalent remote URL, allowing the request to be made without the system's explicit approval.