CVE-2026-102490

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102490

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102490.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102490

Aliases

GHSA-p97w-927q-8vxq

Published

2026-09-30T16:21:20Z

Modified

2026-10-13T02:45:31Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D CVSS Calculator

Summary

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Details

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

Database specific

{
    "cna_assigner":  "DIVD",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102490.json"
}

References

Affected packages

Git / github.com/zammad/zammad

Affected ranges

Type

GIT

Repo

https://github.com/zammad/zammad

Events

Introduced

6e89052a4a744958a89c65057bc5dee9b3b5dc8b

Fixed

295796a2df0b38a579846c017383835657687a22

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.5.0"
        },
        {
            "fixed":  "7.2.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102490.json"