From Service Account to Root: What CVE-2026-102490 Actually Buys an Attacker
Vulnerability overview
Much of the Zammad discussion focuses on the first stage. CVE-2026-102489 provides session hijacking and remote code execution as the zammad user, needing no privileges and only some passive user interaction. CVE-2026-102490 is the step that matters afterwards: local privilege escalation from that service account to root. Individually scored 8.5 on CVSS 4.0, the pair is rated 9.4, Critical, and both records are flagged as exploited in the wild.
Mechanism and exploitation conditions
The distinction between the two stages is really a distinction between access and authority. A shell as zammad grants the ability to read and modify what the application can touch. It does not grant the ability to reconfigure the host, install persistent services, or read root-owned secrets. CVE-2026-102490 closes that gap, and because it requires local access it is only reachable after stage one succeeds.
That precondition is also why the standalone score is lower. Scoring models that evaluate the escalation in isolation understate a chain that DIVD reports as automatable and executed in seconds. Neither the vendor nor DIVD has published the precise defect, so the honest position is that the preconditions and outcomes are known while the internals are not.
Impact
Root changes the character of the incident. Before escalation the attacker has an application-level foothold; afterwards they have the machine, and with it every ticket in the database, the credentials the application uses to reach mail servers and integrations, and a platform for lateral movement. DIVD reported theft of volunteer data including email addresses and possibly contact details, and credited network segmentation with limiting the damage. That credit is itself a measure of how much the escalation step magnifies an otherwise contained intrusion.
Affected products and scope
CVE-2026-102490 affects Zammad 1.5.0 through the 7.1.0 alpha, which spans nearly every release. CVE-2026-102489 is exploitable on 6.3.0 to 6.5.4; 7.0.0 to 7.1.3 contains the bug but is judged not exploitable under present environment conditions. Linux and Docker deployments are affected.
Exposure context
ZoomEye matched 11,977 instances for app="Zammad" at collection time (2026-10-02T06:12:32Z). That describes fingerprint exposure, not confirmed vulnerability, and a vul.cve query for CVE-2026-102490 returned zero indexed assets.
Remediation and mitigations
Upgrade to Zammad version 7 or take the instance offline to remove the remote stage. The escalation flaw persists in current releases, so expect a further patch and apply it quickly. Also run DIVD's log check script, restrict internet access or require VPN, rotate credentials stored on or reachable from the host, and segment the helpdesk from other critical systems. Assume compromise where an affected branch was exposed before patching.
