CVE-2026-102490 is a High (CVSS 7.8) local privilege escalation in Zammad installed from packager.io DEB or RPM packages. The record flags it as known exploited. Zammad said a fix was in progress, so restrict access to the server and follow the vendor advisory.
What's affected
The weakness is CWE-269 (improper privilege management). The record says all released packaged versions are affected, but only installations from the DEB and RPM packages built with packager.io. Installations from source or from the official container images are not affected.
The cause, per the record, is that service processes started as root and executed files that were owned and writable by the unprivileged zammad service account, before dropping to that account. An attacker who already had file system write access as that account could have escalated to root within seconds, since the services restart automatically when they stop. No administrator interaction was needed.
Zammad's advisory dated 5 October 2026 covers this CVE together with CVE-2026-102489. It describes this one as a local privilege escalation that cannot be exploited remotely on its own. It says the issue relates to a confirmed vulnerability in packager.io and that the team is working on a solution. It gives no fixed version.
There is a gap between sources worth noting. The record flags this CVE as being in the CISA Known Exploited Vulnerabilities catalog, but the Zammad advisory we read says nothing about exploitation. Check the CISA entry linked below. The record also lists unrelated looking product names such as Docker and the Linux kernel, so rely on the Zammad advisory for the scope.
How to check if you're exposed
First, find out how Zammad was installed. If it runs from the official container image or from source, the record says it is not affected. If it was installed from a DEB or RPM package from packager.io, it is.
On a Debian or Ubuntu host, a package query shows the origin.
dpkg -l | grep -i zammad
On an RPM based host, use the equivalent.
rpm -qa | grep -i zammad
Next, check who can reach the server. The attacker needs a foothold as the zammad account already, for example through a compromised web application component or a plugin. Review who has shell or file access on the host, and whether the zammad account's files have been modified unexpectedly.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Identify Zammad installs from DEB or RPM packages. Container and source installs are outside the record.
- Restrict access to the underlying server to trusted administrators only, as Zammad recommends.
- If you run Zammad 6.5 or older, update immediately. Zammad says those versions no longer receive security updates.
- Review files owned by the zammad account for unexpected changes and look for unexplained root level activity.
- Watch the Zammad advisory page for the announced fix and apply it when it is released.
- Consider moving to the official container images, which the record says are not affected, if that fits your operations.
Why it matters
Local privilege escalation is the second half of many intrusions. A flaw in a web app or plugin gives the attacker control of the service account, and a flaw like this turns it into control of the host. Running a service as root and executing files that a lower privileged account can modify is a classic design error.
The record flags the CVE as known exploited, and the CISA catalog entry is linked in the sources. Zammad's own advisory does not describe exploitation, so we cannot say how it has been used. The safe assumption is that the package based installs should be locked down until the fix arrives.
Quick check
Is there a fixed Zammad version?
The advisory we read, dated 5 October 2026, says the team is working on a solution and names no fixed version. Check the page for updates.
Does it matter that it is local only?
It means the attacker needs a foothold on the server first. That foothold is exactly what other bugs or stolen credentials can supply, so it still matters.
Sources
- Zammad security advisory
- GitHub advisory GHSA-p97w-927q-8vxq (listed in the record)
- CISA Known Exploited Vulnerabilities entry
- DIVD case DIVD-2026-00015
Last reviewed: 18 October 2026.
