A stored cross-site scripting vulnerability in Zammad version 7.0.1 and prior allows low-privileged users to execute arbitrary scripts, posing a significant risk to administrative session integrity.

This is a stored cross-site scripting (CWE-79) vulnerability occurring because the ticket title field fails to sanitize input during the ticket creation workflow. An authenticated user with low privileges can successfully inject malicious HTML and JavaScript event handlers that persist in the application database.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user's session, including those with administrative privileges. Given the CVSS score of 8.4, this vulnerability represents a high risk as it could lead to full account takeover, unauthorized data access, or the performance of unauthorized actions on behalf of the victim.

Immediate Action: Upgrade Zammad to version 7.0.1 or later to implement the necessary input sanitization on ticket titles.

Proactive Monitoring: Review web server and application logs for anomalous ticket creation patterns or unexpected script execution errors originating from the ticketing interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common cross-site scripting payloads within POST requests targeting the ticket creation endpoint.

Public Exploit Available: Unknown

The high severity of this vulnerability necessitates immediate attention to prevent potential session hijacking and unauthorized administrative actions. Organizations using Zammad must prioritize the update to version 7.0.1 to ensure that input validation is correctly enforced and to neutralize the risk of stored script execution.