Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
Summary
| CVE | CVE-2026-102490 |
|---|---|
| State | PUBLISHED |
| Assigner | DIVD |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-30 17:16:40 UTC |
| Updated | 2026-10-09 14:21:05 UTC |
| Description | Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected. |
Risk And Classification
Primary CVSS: v4.0 9.4 CRITICAL from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
EPSS: 0.005500000 probability, percentile 0.451770000 (date 2026-10-21)
CISA KEV: Listed on 2026-10-02; due 2026-10-05; ransomware use Unknown
Problem Types: CWE-269 | CWE-269 CWE-269 Improper Privilege Management
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.4 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/C... |
| 4.0 | CNA | CVSS | 8.5 | HIGH | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/A... |
| 4.0 | CNA | CVSS | 9.4 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/A... |
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
PassiveConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
HighSub Integrity
HighSub Availability
HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known Exploited Vulnerability
| Vendor | Zammad GmbH |
|---|---|
| Product | Zammad |
| Name | Zammad GmbH Zammad Improper Privilege Management Vulnerability |
| Required Action | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| Notes | https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102490 |
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Zammad GmbH | Zammad | affected 1.5.0 7.2.2 semver | Linux |
| CNA | Zammad GmbH | Zammad | unknown * 1.5.0 semver | Linux |
| CNA | Zammad GmbH | Zammad | unaffected 7.2.2 * semver | Linux |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| csirt.divd.nl/DIVD-2026-00015 | [email protected] | csirt.divd.nl | Third Party Advisory |
| csirt.divd.nl/CVE-2026-102490 | [email protected] | csirt.divd.nl | Third Party Advisory |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq | [email protected] | github.com | Vendor Advisory |
| zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 | [email protected] | zammad.com | Vendor Advisory |
| community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-rep... | MITRE | community.zammad.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
Vendor Comments And Credit
Discovery Credit
CNA: Earth Grob (Merlon Security) (en)
CNA: Luke Paris (Merlon Security) (en)
CNA: Tijmen van der Spijk (Merlon Security) (en)
CNA: Zohar Cochavi (Merlon Security) (en)
CNA: Alje Woltjer (Merlon Security) (en)
CNA: Mischa Rick van Geelen (DIVD) (en)
CNA: Ralph Horn (DIVD) (en)
CNA: Max van der Horst (DIVD) (en)
CNA: Victor Pasman (DIVD) (en)
CNA: Frank Breedijk (DIVD) (en)
CNA: Zammad (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-10-02T00:00:00.000Z | CVE-2026-102490 added to CISA KEV |
There are currently no legacy QID mappings associated with this CVE.