Vulnerability-Lookup

CVE-2026-102490 (GCVE-0-2026-102490)

Vulnerability from cvelistv5 – Published: 2026-09-30 16:21 – Updated: 2026-09-30 16:21

ENISA

Title

Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha

Summary

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C

Assigner

DIVD ENISA root Scorecard

References

2 references

URL	Tags
https://csirt.divd.nl/DIVD-2026-00015	third-party-advisory
https://csirt.divd.nl/CVE-2026-102490	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Zammad GmbH	Zammad	Affected: 1.5.0 , < 7.1.0-alpha (semver) Unknown: * , < 1.5.0 (semver)	guessed

Date Public

2026-09-29 20:00

Credits

Earth Grob (Merlon Security) Luke paris (Merlon Security) Tijmen van der Spijk (Merlon Security) Zohar Cochavi (Merlon Security) Alje Woltjer (Merlon Security) Mischa Rick van Geelen (DIVD) Ralph Horn (DIVD) Max van der Horst (DIVD) Victor Pasman (DIVD) Frank Breedijk (DIVD)

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 307e63c8-7bfd-4929-8a7b-8ccb5c4f543e

Vulnerability ID: CVE-2026-102490

Status: Confirmed

Status Updated: 2026-09-30 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-09-30

Asserted: 2026-09-30

Scope

Notes: Affected: Zammad / Zammad | Description: All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root. | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu

Evidence

Type: Csirt Report

Signal: Successful Exploitation

Confidence: 75%

Source: enisa-cnw-kev

Details

Cwes
Euvd	EUVD-2026-90081
Notes	https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
Catalog	ENISA / EU CSIRTs Network (CNW) KEV JSON
Product	Zammad
Datereported	2026/09/30
Originsource	NCSC-NL
Patchedsince
Vendorproject	Zammad
Exploitationtype	unknown
Vulnerabilityname
Threatactorsexploiting

References

Created: 2026-10-01 08:00 UTC | Updated: 2026-10-01 08:00 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Docker"
          ],
          "product": "Zammad",
          "vendor": "Zammad GmbH",
          "versions": [
            {
              "lessThan": "7.1.0-alpha",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.5.0",
              "status": "unknown",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Earth Grob (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Luke paris (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tijmen van der Spijk (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zohar Cochavi (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Alje Woltjer (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Mischa Rick van Geelen (DIVD)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ralph Horn (DIVD)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Max van der Horst (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Pasman (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Frank Breedijk (DIVD)"
        }
      ],
      "datePublic": "2026-09-29T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
            }
          ],
          "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "ATTACKED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "ATTACKED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Chained with CVE-2026-102489"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T16:21:20.601Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/DIVD-2026-00015"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2026-102490"
        }
      ],
      "source": {
        "advisory": "DIVD-2026-00015",
        "discovery": "INTERNAL"
      },
      "title": "Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2026-102490",
    "datePublished": "2026-09-30T16:21:20.601Z",
    "dateReserved": "2026-09-29T09:46:12.490Z",
    "dateUpdated": "2026-09-30T16:21:20.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Linux",
                  "Docker"
                ],
                "product": "Zammad",
                "vendor": "Zammad GmbH",
                "versions": [
                  {
                    "lessThan": "7.1.0-alpha",
                    "status": "affected",
                    "version": "1.5.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.5.0",
                    "status": "unknown",
                    "version": "*",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "csirt@divd.nl"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
          }
        ],
        "id": "CVE-2026-102490",
        "lastModified": "2026-09-30T19:57:08.043",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "YES",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "ATTACKED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "PASSIVE",
                "valueDensity": "CONCENTRATED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "csirt@divd.nl",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-30T17:16:40.707",
        "references": [
          {
            "source": "csirt@divd.nl",
            "url": "https://csirt.divd.nl/CVE-2026-102490"
          },
          {
            "source": "csirt@divd.nl",
            "url": "https://csirt.divd.nl/DIVD-2026-00015"
          }
        ],
        "sourceIdentifier": "csirt@divd.nl",
        "vulnStatus": "Deferred"
      }
    }
  }
}

FKIE_CVE-2026-102490

Vulnerability from fkie_nvd - Published: 2026-09-30 17:16 - Updated: 2026-09-30 19:57

ENISA

Severity

9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C

Summary

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

References

	URL	Tags
	csirt@divd.nl	https://csirt.divd.nl/CVE-2026-102490
	csirt@divd.nl	https://csirt.divd.nl/DIVD-2026-00015

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Docker"
          ],
          "product": "Zammad",
          "vendor": "Zammad GmbH",
          "versions": [
            {
              "lessThan": "7.1.0-alpha",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.5.0",
              "status": "unknown",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "csirt@divd.nl"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
    }
  ],
  "id": "CVE-2026-102490",
  "lastModified": "2026-09-30T19:57:08.043",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "ATTACKED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "PASSIVE",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "csirt@divd.nl",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-30T17:16:40.707",
  "references": [
    {
      "source": "csirt@divd.nl",
      "url": "https://csirt.divd.nl/CVE-2026-102490"
    },
    {
      "source": "csirt@divd.nl",
      "url": "https://csirt.divd.nl/DIVD-2026-00015"
    }
  ],
  "sourceIdentifier": "csirt@divd.nl",
  "vulnStatus": "Deferred"
}

GHSA-HGFF-G8G3-4XR8

Vulnerability from github – Published: 2026-09-30 18:33 – Updated: 2026-09-30 18:33

Details

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

Severity

9.4 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-102490"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-30T17:16:40Z",
    "severity": "CRITICAL"
  },
  "details": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.",
  "id": "GHSA-hgff-g8g3-4xr8",
  "modified": "2026-09-30T18:33:49Z",
  "published": "2026-09-30T18:33:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102490"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/CVE-2026-102490"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/DIVD-2026-00015"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

NCSC-2026-0396

Vulnerability from csaf_ncscnl - Published: 2026-09-30 17:31 - Updated: 2026-09-30 17:31

Summary

Kwetsbaarheden aangetroffen in Zammad

Scope

2 vulnerabilities in this advisory, including CVE-2026-102490.

CVE-2026-102490

All versions of Zammad, including the latest alpha release, contain a local privilege escalation vulnerability allowing the zammad user to gain root access.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-102490 (GCVE-0-2026-102490)

ENISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Csirt Report Successful Exploitation Confidence: 75% Source: enisa-cnw-kev

Details

References

FKIE_CVE-2026-102490

GHSA-HGFF-G8G3-4XR8

NCSC-2026-0396

Tags

Sightings

Nomenclature

Related by attack behaviour