Privilege Escalation Vulnerability in Zammad by Zammad
CVE-2026-102490

9.4CRITICAL

Key Information:

Vendor

Zammad Gmbh

Status
Zammad
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102490?

A vulnerability exists in all versions of Zammad, allowing a local user to escalate their privileges to root. This flaw could enable unauthorized access and control over the system, posing significant risks to data integrity and confidentiality. It is critical for users and administrators to apply necessary security measures to mitigate potential exploitation.

Affected Version(s)

Zammad Linux 1.5.0 < 7.1.0-alpha

References

https://csirt.divd.nl/DIVD-2026-00015
third-party-advisory
https://csirt.divd.nl/CVE-2026-102490
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Earth Grob (Merlon Security)
Luke paris (Merlon Security)
Tijmen van der Spijk (Merlon Security)
Zohar Cochavi (Merlon Security)
Alje Woltjer (Merlon Security)
Mischa Rick van Geelen (DIVD)
Ralph Horn (DIVD)
Max van der Horst (DIVD)
Victor Pasman (DIVD)
Frank Breedijk (DIVD)
.