A stored cross‑site scripting flaw exists in Zammad’s admin interface for configuring AI Agents. The application emits option labels as raw HTML without escaping; if an attacker can set a malicious option label—by creating a user or organization name used in a relation attribute or by supplying a crafted custom attribute—arbitrary HTML and JavaScript can be injected. When an administrator or agent opens the affected configuration view, the payload runs in the victim’s browser, enabling theft of session data, credential compromise, or further lateral movement. The flaw is a classic client‑side injection and does not directly grant privileged back‑door access but can be leveraged to subvert user interactions.

Zammad helpdesk software, all installations running a version earlier than 7.1.2. The issue is present in every release before 7.1.2 and is addressed by the 7.1.2 update. No other vendors or products are affected.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires the ability to edit or create option labels, a capability typically reserved for administrators. Once an attacker achieves this, the attack vector is a plain web‑interface interaction with no additional external payload. The risk is therefore moderate, driven largely by the need for privileged UI access rather than a public remote exploit.