CVE-2026-102490 GHSA-p97w-927q-8vxq

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

High Known exploited

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 10.94%; Chance of exploitation in the next 30 days. Higher than 95.88% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Oct 2, 2026
Weakness: CWE-269 Improper Privilege Management
Fix: None yet; No fixed version published

Exploited in the wild. Zammad GmbH Zammad Improper Privilege Management Vulnerability (Zammad GmbH Zammad). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Oct 5, 2026.

Description

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Attacked

CVSS 3.1 7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

Advisories

Timeline

Sep 30, 2026 Published
Oct 2, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Oct 5, 2026 Remediation due for U.S. federal agencies
Oct 28, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key	Critical	Same weakness, CWE-269
GO-2026-6791 containerd CRI plugin: Checkpoint restore bypasses destination security context	High	Same weakness, CWE-269
GHSA-pjr3-86v4-5p7w Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)	Medium	Same weakness, CWE-269
GHSA-v3p6-34mc-hj7v Vikunja: Scoped API token can mint unrestricted OAuth session credentials	High	Same weakness, CWE-269
GHSA-4pvx-fwjj-8gpc Ghost: Editors Could Promote Staff Users to Their Own Role	Medium	Same weakness, CWE-269
GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions	Critical	Same weakness, CWE-269
GHSA-3w57-8xmc-8v26 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups	High	Same weakness, CWE-269
GHSA-6rh5-qq4q-97xh vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes	High	Same weakness, CWE-269

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor