CVE-2026-63208

MediumCVSS 5.1/10Last modified Sep 28, 2026

Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft uses (JWT), only the first part is hidden, while the remaining parts remain readable in plain text. A Zammad admin with Microsoft Graph channel access can view these logs and see the partial token, which may reveal sensitive claims such as the account scope, tenant, or timing, and could assist in reconstructing the full token while it is still valid. This issue is fixed in version 7.1.2.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-116 CWE-532

Affected software

Vendor	Product	Versions
zammad	zammad	< 7.1.2

References

Timeline

Published: Sep 25, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-632097.5compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an CVE-2026-63217.5fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functio CVE-2026-632137.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Up CVE-2026-632148.8SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy CVE-2026-632158.3SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the RE CVE-2026-632165.3Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configurat CVE-2026-632176.5SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the ge CVE-2026-632186.5SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the ch CVE-2026-632198.6GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for crea CVE-2026-63227.5fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters durin CVE-2026-632204.8CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Fro CVE-2026-632219.4CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() c