Zammad 7.1.2

Recommended Resolution

SaaS Customers: No action is required. Your instances have already been patched and secured by our team.

Self-Hosted Installations: We strongly advise upgrading to the latest version of Zammad immediately to ensure your system is protected.

Vulnerabilities patched

For full technical details, please refer to the security advisories on GitHub.

• AI Agent template sanitizer bypass leads to remote code execution
• S/MIME signature verification allows forged sender impersonation
• Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
• IDOR in External Data Source rendering exposes ticket, user, group, and organization data
• Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
• Missing article authorization in ticket attachment clone endpoint
• Pending upload deletion bypass via legacy attachment endpoint
• Account takeover via unverified email matching during SSO auto-link
• HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
• Stored XSS via unescaped option labels in the object attribute options context UI
• Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
• Missing rate limiting allows password brute-forcing during two-factor login
• Sensitive Information Exposure in Integration Administration API
• Microsoft Graph error logs expose partially masked OAuth access tokens
• Channel admins can read unauthorized attachments via signature rich-text body
• Authenticated agents can read AI summary error messages from inaccessible tickets
• Remote image tracking bypass via shortened URL scheme
• Stored XSS in ticket article rendering in the new Vue-based interface

📣 Important Announcements

Knowledge Base: New Search Index Field for Publication Status

Starting with Zammad 7.2, the search index for Knowledge Base answer translations includes the new publication_state field. This allows searches to be filtered by an answer’s current publication status:

• draft – draft
• internal – internal
• published – published
• archived – archived

This change is part of the new “Suggested Searches” feature in the Knowledge Base search.

To make the new field available after upgrading to Zammad 7.2, the search index must be rebuilt once:

bash zammad run rake zammad:searchindex:rebuild

Without rebuilding the search index, queries such as publication_state:draft will not return any results.

Calendar iCal feed must be a URL

Starting with Zammad 7.2, the functionality of using local file paths for calendars iCal feed source will be removed.

Deprecated es-ca locale inactivated

The deprecated es-ca locale for Catalan will no longer be offered for selection starting with Zammad 7.2. Users still set to es-ca will be automatically migrated to the proper ca locale. Existing Knowledge Base locales referencing es-ca will not be migrated automatically due to the URL change and must be updated manually.

Stricter default Content-Security-Policy

Starting with Zammad 7.2, the default Content-Security-Policy header will include a new frame-ancestors 'self' directive.

⚠️ Setups that currently allow the Zammad web interface to be embedded in an <iframe> on a different origin by overriding the X-Frame-Options header at the reverse proxy will now be blocked again by the new frame-ancestors 'self' CSP directive. To re-enable embedding from trusted origins, the frame-ancestors directive of the Content-Security-Policy response header must be adjusted at the reverse proxy as well.