CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

The CVE record published by Threatint says the flaw lets the local zammad user escalate privileges to root[2] in all versions of Zammad, including the latest alpha. PSIRT.com lists the flaw at CVSS 9.4[3] and marks it Exploited in the Wild[3].The HOL Blog reports that the Dutch Institute for Vulnerability Disclosure (DIVD) lists affected from 1.5.0 before 7.1.0-alpha[1]. According to the same blog, DIVD published the CVEs after investigating its own network breach[1]. DIVD also says the chain was used in an automated attack against its Zammad instance[1].HOL reports that CISA says the flaw can be chained with CVE-2026-102489[1], a session fixation bug. HOL describes the combined result as a network path into RCE as zammad, then root on the host[1]. RunZero reports that the vendor disputed the report and said it had not received technical details from DIVD[4]. HOL reports that Zammad's October 1 community thread says it received technical details from DIVD and is working the fix[1].RunZero reports that Zammad has not released an official patch as of this writing[4]. RunZero also urges users to upgrade to version 7.2.0 or later[4].A post on Zammad's community forum tells administrators: "If your instance is publicly exposed - patch urgently."[5]