Vulnerability-Lookup

CVE-2026-102490 (GCVE-0-2026-102490)

Vulnerability from cvelistv5 – Published: 2026-09-30 16:21 – Updated: 2026-10-03 03:55

Title

Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha

Summary

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 00:00 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

DIVD ENISA root

References

3 references

URL	Tags
https://csirt.divd.nl/DIVD-2026-00015	third-party-advisory
https://csirt.divd.nl/CVE-2026-102490	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
Zammad GmbH	Zammad	Affected: 1.5.0 , < 7.1.0-alpha (semver) Unknown: * , < 1.5.0 (semver)

Date Public

2026-09-29 20:00

Credits

Earth Grob (Merlon Security) Luke Paris (Merlon Security) Tijmen van der Spijk (Merlon Security) Zohar Cochavi (Merlon Security) Alje Woltjer (Merlon Security) Mischa Rick van Geelen (DIVD) Ralph Horn (DIVD) Max van der Horst (DIVD) Victor Pasman (DIVD) Frank Breedijk (DIVD)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102490",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-10-02",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T03:55:35.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-10-02T00:00:00.000Z",
            "value": "CVE-2026-102490 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Docker"
          ],
          "product": "Zammad",
          "vendor": "Zammad GmbH",
          "versions": [
            {
              "lessThan": "7.1.0-alpha",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.5.0",
              "status": "unknown",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Earth Grob (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Luke Paris (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tijmen van der Spijk (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zohar Cochavi (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Alje Woltjer (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Mischa Rick van Geelen (DIVD)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ralph Horn (DIVD)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Max van der Horst (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Pasman (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Frank Breedijk (DIVD)"
        }
      ],
      "datePublic": "2026-09-29T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
            }
          ],
          "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "ATTACKED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "ATTACKED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Chained with CVE-2026-102489"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T09:00:16.013Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/DIVD-2026-00015"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2026-102490"
        }
      ],
      "source": {
        "advisory": "DIVD-2026-00015",
        "discovery": "INTERNAL"
      },
      "title": "Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2026-102490",
    "datePublished": "2026-09-30T16:21:20.601Z",
    "dateReserved": "2026-09-29T09:46:12.490Z",
    "dateUpdated": "2026-10-03T03:55:35.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-102490",
      "date": "2026-10-03",
      "epss": "0.00629",
      "percentile": "0.48335"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-102490",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-02T16:27:22.630800Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-10-02",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490"
                  },
                  "type": "kev"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-269",
                    "description": "CWE-269 Improper Privilege Management",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-01T17:54:19.301Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2026-10-02T00:00:00.000Z",
                "value": "CVE-2026-102490 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Linux",
                "Docker"
              ],
              "product": "Zammad",
              "vendor": "Zammad GmbH",
              "versions": [
                {
                  "lessThan": "7.1.0-alpha",
                  "status": "affected",
                  "version": "1.5.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.5.0",
                  "status": "unknown",
                  "version": "*",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Earth Grob (Merlon Security)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Luke Paris (Merlon Security)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Tijmen van der Spijk (Merlon Security)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Zohar Cochavi (Merlon Security)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Alje Woltjer (Merlon Security)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Mischa Rick van Geelen (DIVD)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Ralph Horn (DIVD)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Max van der Horst (DIVD)"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Victor Pasman (DIVD)"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Frank Breedijk (DIVD)"
            }
          ],
          "datePublic": "2026-09-29T20:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
                }
              ],
              "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "YES",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "exploitMaturity": "ATTACKED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "DIFFUSE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "YES",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "ATTACKED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "PASSIVE",
                "valueDensity": "CONCENTRATED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "Chained with CVE-2026-102489"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-02T09:00:16.013Z",
            "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
            "shortName": "DIVD"
          },
          "references": [
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://csirt.divd.nl/DIVD-2026-00015"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://csirt.divd.nl/CVE-2026-102490"
            }
          ],
          "source": {
            "advisory": "DIVD-2026-00015",
            "discovery": "INTERNAL"
          },
          "title": "Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha",
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "assignerShortName": "DIVD",
        "cveId": "CVE-2026-102490",
        "datePublished": "2026-09-30T16:21:20.601Z",
        "dateReserved": "2026-09-29T09:46:12.490Z",
        "dateUpdated": "2026-10-02T19:58:23.702Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-103199

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-03 11:57

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-03T11:57:42.666660+00:00",
  "id": "EUVD-2026-103199"
}

FKIE_CVE-2026-102490

Vulnerability from fkie_nvd - Published: 2026-09-30 17:16 - Updated: 2026-10-03 04:18

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

References

URL	Tags
csirt@divd.nl	https://csirt.divd.nl/CVE-2026-102490	Third Party Advisory
csirt@divd.nl	https://csirt.divd.nl/DIVD-2026-00015	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490	US Government Resource

Impacted products

Vendor	Product	Version
zammad	zammad	*
zammad	zammad	7.1.0
docker	docker	-
linux	linux_kernel	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Docker"
          ],
          "product": "Zammad",
          "vendor": "Zammad GmbH",
          "versions": [
            {
              "lessThan": "7.1.0-alpha",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.5.0",
              "status": "unknown",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "csirt@divd.nl"
    }
  ],
  "cisaActionDue": "2026-10-05",
  "cisaExploitAdd": "2026-10-02",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F35B8C68-B265-4574-BEF5-51FC1CB4DF77",
              "versionEndExcluding": "7.1.0",
              "versionStartIncluding": "1.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zammad:zammad:7.1.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "4DD0F01F-638A-4E1E-A53A-F38EF44D196B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "231A8A55-A319-4878-91DA-4FD91CF0549E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
    }
  ],
  "id": "CVE-2026-102490",
  "lastModified": "2026-10-03T04:18:00.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "ATTACKED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "PASSIVE",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "csirt@divd.nl",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-102490",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-02T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-30T17:16:40.707",
  "references": [
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://csirt.divd.nl/CVE-2026-102490"
    },
    {
      "source": "csirt@divd.nl",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://csirt.divd.nl/DIVD-2026-00015"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490"
    }
  ],
  "sourceIdentifier": "csirt@divd.nl",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-HGFF-G8G3-4XR8

Vulnerability from github – Published: 2026-09-30 18:33 – Updated: 2026-10-02 18:31

Details

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-102490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-30T17:16:40Z",
    "severity": "CRITICAL"
  },
  "details": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.",
  "id": "GHSA-hgff-g8g3-4xr8",
  "modified": "2026-10-02T18:31:16Z",
  "published": "2026-09-30T18:33:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102490"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/CVE-2026-102490"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/DIVD-2026-00015"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

NCSC-2026-0396

Vulnerability from csaf_ncscnl - Published: 2026-09-30 17:31 - Updated: 2026-09-30 17:31

Summary

Kwetsbaarheden aangetroffen in Zammad

Scope

2 vulnerabilities in this advisory, including CVE-2026-102490.

CVE-2026-102490

All versions of Zammad, including the latest alpha release, contain a local privilege escalation vulnerability allowing the zammad user to gain root access.

Known affected: 1 product

Open the full advisory

WID-SEC-W-2026-3694

Vulnerability from csaf_certbund - Published: 2026-09-30 22:00 - Updated: 2026-10-01 22:00

Summary

Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und Privilegieneskalation

Severity

Kritisch

Scope

2 vulnerabilities in this advisory, including CVE-2026-102490.

CVE-2026-102490

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-102490 (GCVE-0-2026-102490)

EUVD-2026-103199

FKIE_CVE-2026-102490

GHSA-HGFF-G8G3-4XR8

NCSC-2026-0396

WID-SEC-W-2026-3694

Tags

Sightings

Nomenclature

Related by attack behaviour