Security Advisory Details

  • ID: ZAA-2026-01
  • Date: 2026-03-04
  • Title: Insufficiently Protected Credentials
  • Severity: low
  • Product: Zammad 6.5.x
  • Fixed in: Zammad 7.0.0
  • References:
    --> pending CVE assignment

Vulnerability Descriptions

Insufficiently Protected Credentials

Sensitive information in the admin panel, such as API tokens, secrets, and other credentials were transmitted back to the client. Even though the Zammad UI showed them in password fields, there were ways to extract them from the browser context, or retrieve them via API directly.

This was changed to mask sensitive fields with ********** when transmitting them to clients.

Special 🙏 and 🤘 and ❤️ to:

  • N: Axel Charpentier
  • C: Cogiceo
  • W: www.cogiceo.com

For our SaaS customers, there’s nothing you need to worry about: we’ve already taken care of everything for you.

For self hosted installations, we strongly advise admins to update their system to the latest release of Zammad.

Fixed releases can be found at:

Or just update your Zammad if installed via OS package manager.

Additional information

Online version of this advisory: https://zammad.com/en/advisories/zaa-2026-01

Please see our security policy and send remarks on security issues exclusively to security@zammad.com.