03 October 2026
Reference: CVE-2026-102490
1. What is being reported?
The vulnerability means that any user who can log in locally as the 'zammad' user on the system can escalate their access rights to become the root user, which has unlimited control over the system. This affects every version of Zammad, including the latest test versions.
2. What this means in plain English
If an attacker or unauthorised person gains local access to your Zammad system, they could take over the entire server. This could lead to data theft, disruption of services, or further attacks on your network.
3. Could this affect a small business?
Small organisations using Zammad for managing customer support or internal tickets could be affected, especially if the system is accessible to multiple users or not properly secured. If you do not use Zammad, or it is not exposed to untrusted users, the risk is lower.
4. What to do now
- Contact your IT provider or software supplier immediately to check if you use Zammad and confirm your version.
- Apply any vendor-recommended mitigations or updates as soon as they become available.
- Review who has local access to your Zammad system and restrict it to trusted personnel only.
- If you use cloud services for Zammad, ensure your provider follows the latest security guidance or consider discontinuing use until the issue is resolved.
5. Ask your IT provider
Can you confirm if our organisation uses Zammad, and if so, what steps are being taken to mitigate the CVE-2026-102490 privilege escalation vulnerability?
6. Bottom line
If you use Zammad, act quickly to prevent attackers from gaining full control of your system.
Information based on CISA KEV, NVD, and reputable security reporting.