Zero Radar
← feed
CriticalVulnerabilityCVE-2026-102490updated 25 Oct 2026, 17:35 UTC

Zammad support software: local user can gain full system control

A normal account on the Zammad server could take over the entire server, including all its data. Attackers who already have a foothold on the machine can use this to get full control.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalCVSS 9.4 of 10
Being exploited?YesConfirmed by CISA KEV · 2 Oct 2026,
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Local accountAttacker has zammad user access
  2. 2Privilege flawImproper privilege management in Zammad
  3. 3Root accessEscalates from zammad user to root
  4. 4Data exposedFull control of server and stored data
  5. ResultAttacker gains root on the server

What happened

Zammad's improper privilege management lets the local zammad user escalate privileges to root. It can be chained with CVE-2026-102489.

Why it is dangerous: Once an attacker gains root, they can read, change, or delete all customer and support data and install persistence. Organizations running self-hosted Zammad are at risk.

Are you affected?

You are affected if you run Zammad (self-hosted) on any version, including the latest alpha, where local users including the zammad account can reach the vulnerable privilege path.

All versions of Zammad, including the latest alpha, per GitHub Advisory.

What to do

  1. Check the Zammad vendor site and GitHub advisory GHSA-hgff-g8g3-4xr8 for a patched release and apply it as soon as available
  2. Apply the vendor's mitigations now, following CISA BOD 26-04 guidance
  3. Restrict local shell and account access to the Zammad server to trusted administrators only
  4. If no mitigation is available, consider discontinuing use of Zammad until a fix is released, and review the server for signs of compromise per CISA's forensics triage requirements

Timeline

  1. 30 Sept 2026, 18:33 UTC
    Publicly disclosed
  2. 2 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102490 · GHSA-hgff-g8g3-4xr8
CVSS
9.4 / 10
EPSS
11% chance of exploitation within 30 days
Disclosed
30 Sept 2026, 18:33 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Zammad support software: local user can gain full system control · Zero Radar