Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.4
CVE-2026-102490: Zammad lets local user gain admin rights
CVE-2026-102490 · published 19 days ago · actively exploited
Summary
The Zammad ticket system on your server can let a regular user on the machine upgrade their access to full administrator (root) level. This could let an attacker take control of the entire system. Apply the latest Zammad update or follow the vendor’s guidance to fix the permission settings.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zammad gmbh | zammad |
< 7.1.0-alpha < 7.2.2 |
| zammad | zammad |
>= 1.5.0, < 7.1.0 7.1.0 < 7.2.2 cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* |
Original advisory text
Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
References
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102... Vendor Advisory
- https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 Vendor Advisory
- https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1024... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102490 Vendor Advisory
- https://csirt.divd.nl/DIVD-2026-00015 Vendor Advisory
- https://csirt.divd.nl/CVE-2026-102490 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... URL
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.4
High
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
<1%
chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published30 Sep 2026
Updated19 Oct 2026
First seen30 Sep 2026
Sources
CVE-2026-102490 · NVD
CVE-2026-102490 · MITRE
CVE-2026-102490 · CISA KEV
CVE-2026-102490 · OSV
GHSA-p97w-927q-8vxq · GHSA
Track software like this
Free during beta