CVE-2026-102490
Received Received - Intake

Privilege Escalation in Zammad via Local User

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Dutch Institute for Vulnerability Disclosure

Description
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102490
EUVD
EUVD-2026-90081

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zammad zammad *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows the local zammad user to escalate privileges to root in all versions of Zammad, including the latest alpha release. This means an attacker with local access could gain full control over the system.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users with local access to take complete control of the system, leading to data breaches, unauthorized modifications, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA, which mandate strict access controls and data protection measures.

Mitigation Strategies

Immediately restrict local user access to the zammad system and audit all privilege escalation attempts. Update Zammad to the latest patched version as soon as it becomes available. Monitor system logs for unauthorized privilege changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart