Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
References
| Link | Resource |
|---|---|
| https://csirt.divd.nl/CVE-2026-102490 | Third Party Advisory |
| https://csirt.divd.nl/DIVD-2026-00015 | Third Party Advisory |
| https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq | Vendor Advisory |
| https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490 | US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
09 Oct 2026, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | ||
| References | () https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq - Vendor Advisory |
08 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected. | |
| References |
|
|
07 Oct 2026, 17:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 - Vendor Advisory | |
| References | () https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 - Vendor Advisory |
07 Oct 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Oct 2026, 17:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490 - US Government Resource |
02 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:zammad:zammad:7.1.0:alpha:*:*:*:*:*:* cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* |
|
| First Time |
Zammad
Linux Linux linux Kernel Docker docker Zammad zammad Docker |
|
| References |
|
|
| References | () https://csirt.divd.nl/CVE-2026-102490 - Third Party Advisory | |
| References | () https://csirt.divd.nl/DIVD-2026-00015 - Third Party Advisory |
02 Oct 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-269 |
30 Sep 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-30 17:16
Updated : 2026-10-09 14:21
NVD link : CVE-2026-102490
Mitre link : CVE-2026-102490
CVE.ORG link : CVE-2026-102490
JSON object : View
Products Affected
linux
- linux_kernel
docker
- docker
zammad
- zammad
CWE
CWE-269
Improper Privilege Management