CVE-2026-102490: Zammad DEB/RPM Package Local Privilege Escalation to Root

CVE-2026-102490 is a local privilege-escalation vulnerability in Zammad's DEB and RPM packages (built with packager.io): service processes run as root but execute files owned and writable by the unprivileged zammad service account before dropping to it, so a local attacker who already has a foothold as that account can escalate to root within seconds, and it is on the CISA KEV catalog with third-party reports — disputed by Zammad at the time — of active exploitation.

CVE-2026-102490 affects Zammad, an open-source customer-support/helpdesk ticketing system, specifically its DEB and RPM packages built with the third-party packager.io service. NVD's description explains the root cause: "Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account" (NVD).

NVD's own published score is CVSS v3.1 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, low complexity, low privileges required. The finder, DIVD (Dutch Institute for Vulnerability Disclosure), rates it higher as a CNA submission: CVSS v4.0 9.4 (critical) when chained with the related CVE-2026-102489, or 8.5 (high) standalone (NVD; DIVD CSIRT advisory).

DIVD and Merlon Security, credited as co-discoverers, state the affected range is "Zammad versions 1.5.0 through 7.2.2" installed via DEB or RPM packages, with the fix landing in 7.2.2 and later; only packaged installations were vulnerable, while source-code and official container-image deployments were unaffected (DIVD CSIRT advisory).

Zammad's own GitHub security advisory confirms the same mechanics in more detail: an attacker already holding code-execution as the unprivileged zammad service account could escalate to full root on the host, because the affected services "began running as root and executed files that were owned and writable by the zammad account before dropping their identity," combined with a writable installation directory; it states the fixed version is 7.2.2, affecting 7.2.1 and earlier, and that this issue "cannot be exploited remotely on its own" since it requires prior local access (Zammad GHSA-p97w-927q-8vxq).

CISA added CVE-2026-102490 to the KEV catalog on 2026-10-02 with a required-action due date of 2026-10-05, noting it "can be chained with CVE-2026-102489" and flagging the entry for forensic-triage requirements under BOD 26-04; known ransomware-campaign use is listed as "Unknown" (CISA KEV).

Notably, in an early Zammad community-forum post responding to third-party reports that the flaw was "actively exploited," Zammad's own team pushed back on the claim, stating "up to today, DIVD has not given us any technical details about this vulnerability" and recommending administrators update to the then-current stable release while the full advisory was finalized — a reminder that initial exploitation claims around a KEV listing are not always confirmed by the vendor at the time they circulate (Zammad community forum).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.00857 (58.237th percentile). Operators running Zammad's DEB or RPM packages should upgrade to 7.2.2 or later; those on source installs or the official container image are not affected by this specific issue (FIRST EPSS).

• Root cause: packager.io-built DEB/RPM service processes run as root but execute files owned/writable by the unprivileged zammad account before dropping to it, enabling local privilege escalation to root (CWE-269). — NVD
• NVD-published CVSS v3.1 base score is 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; DIVD's CNA submission scores it CVSS v4.0 9.4 (chained with CVE-2026-102489) or 8.5 standalone. — NVD
• Affected: Zammad 1.5.0 through 7.2.1/7.2.2 via DEB/RPM packages only, fixed in 7.2.2; source installs and the official container image are unaffected. — DIVD CSIRT advisory
• Confirms the root-escalation mechanics, fixed version 7.2.2 (affecting 7.2.1 and earlier), and that the issue requires prior local access and cannot be exploited remotely on its own. — Zammad GitHub Security Advisory GHSA-p97w-927q-8vxq
• Added to the CISA KEV catalog on 2026-10-02, due date 2026-10-05, notes it can be chained with CVE-2026-102489, flagged for forensic-triage requirements under BOD 26-04. — CISA KEV
• Zammad's own team disputed early third-party "actively exploited" claims, stating DIVD had not yet shared technical details, and recommended updating to the then-current stable release. — Zammad community forum
• EPSS score is 0.00857 (58.237th percentile) as of 2026-10-27. — FIRST EPSS