CVE-2026-63205 zammad CVE debrief

Who should care

Defenders responsible for Zammad installations, especially those with users having admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions, should assess exposure and verify remediation.

Why it matters

CVE-2026-63205 allows users with certain admin permissions to access attachments they shouldn't in Zammad. Defenders should verify and remediate this vulnerability, especially those with admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions.

• Users with certain admin permissions can access attachments they shouldn't
• Potential unauthorized data access
• Need to verify and restrict permissions for users with admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions
• Remediation priority for Zammad installations

Technical summary

The vulnerability exists in Zammad's email signature processing. When a user creates or updates an email signature with an HTML img tag referencing an existing attachment, the system copies that attachment into a new signature-owned record. This allows users with certain admin permissions to access attachments they shouldn't, such as ticket attachments belonging to groups they are not a member of.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially those with admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions.

Recommended defensive actions

• Verify Zammad version and check if it's vulnerable
• Restrict permissions for users with admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions
• Monitor for suspicious activity related to email signatures and attachments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but evidence is limited. The CVE Program and NVD provide official records, but further verification is needed to determine the full scope of affected systems and remediation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.