CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Records published by OffSeq describe CVE-2026-102490 like this: "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."[3] Tech Times reports that the flaw "runs from version 1.5.0 through the current v7.1.0-alpha."[2]According to BleepingComputer, the Dutch Institute for Vulnerability Disclosure (DIVD) says its network was breached through a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system.[4] SecurityWeek reports that the attack happened on September 21.[1]DIVD said in a post quoted by BleepingComputer, as reported by GBlock, that the two flaws "allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root"[5] within seconds.Rescana reports that CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on 2 October 2026[6]. Rescana adds that NVD scores each one 9.8 Critical under CVSS 3.1.[6]SecurityWeek reports that DIVD advised users "to upgrade to version 7 of Zammad or to take it offline."[1] However, Tech Times reports that upgrading to version 7 does not fix CVE-2026-102490[2].Zammad's advisory says details of CVE-2026-102490 went public before the company had the technical information it needed to reproduce the issue.[7] The company says it is now "addressing the issue as a high priority."[7]Rescana reports that Zammad publicly disagreed with DIVD over which versions are affected, whether CVE-2026-102490 can be exploited on its own, and how the disclosure was handled.[6]