CVE-2026-102489

Analyzed Analyzed - Analysis Complete

Session Hijack Leading to RCE in Zammad

Publication date: 2026-09-30

Last updated on: 2026-10-10

Assigner: Dutch Institute for Vulnerability Disclosure

Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-10

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102489

EUVD

EUVD-2026-90080

Affected Vendors & Products

Vendor	Product	Version / Range
zammad	zammad	From 6.3.0 (inc) to 6.5.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

Zammad versions 6.3.0 to 6.5.4 have a session hijack vulnerability that allows remote code execution as the zammad user. The issue also affects versions 7.0.0 to 7.1.3 but is not exploitable due to specific environment conditions.

Impact Analysis

An attacker could hijack sessions and execute arbitrary code on the affected system with the privileges of the zammad user. This could lead to full system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Immediately upgrade Zammad to a patched version (6.5.5 or later, or 7.1.4 or later) to address the session hijack vulnerability. Verify the upgrade was successful and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-102489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70