Zammad’s integration administration API exposes stored credentials for LDAP and Exchange integrations to any authenticated administrator. The API fails to mask sensitive fields consistently, returning secrets in clear text rather than a placeholder. This flaw allows privileged users to obtain plaintext configuration data, potentially revealing network addresses, usernames, passwords, or tokens. The weakness falls under information disclosure weaknesses (CWE-200), cleartext storage (CWE-312), and insufficient local authentication controls (CWE-522).

The vulnerability affects Zammad 7.0.3 and 7.1.1. The flaw is resolved in version 7.1.2 and later releases. Administrators running the affected versions are at risk if their accounts are compromised or if they grant administrative privileges broadly.

The CVSS score of 6.9 indicates a moderate to high risk level. Because the vulnerability requires administrative authentication, it is predominantly a matter of insider threat or credential compromise, not a public remote exploit. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation at present. However, exposed credentials can lead to lateral movement, unauthorized access to downstream services, and further compromise of the organization’s infrastructure.