Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. Can be chained with CVE-2026-102489. Added to CISA KEV on 2026-10-02 (federal deadline 2026-10-05).

First seen: 2 Oct 2026
Last update: 2 Oct 2026, 12:00 UTC
Identifiers: CVE-2026-102489
CVE-2026-102490
CVSS: 9.8
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Zammad GmbH Zammad Improper Privilege Management Vulnerability
Severity: critical, exploited in the wild. Patch status: patched.
Affected: Zammad GmbH Zammad
Ids: CVE-2026-102489, CVE-2026-102490

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. Can be chained with CVE-2026-102489. Added to CISA KEV on 2026-10-02 (federal deadline 2026-10-05).

## Steps
1. Search the repo, its CI and infra config for Zammad GmbH Zammad. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-102489") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 https://nvd.nist.gov/vuln/detail/CVE-2026-102489 https://nvd.nist.gov/vuln/detail/CVE-2026-102490 https://zammad.com/en/product/releases/
https://pwned.coffee/i/zammad-gmbh-zammad-improper-privilege-management-vulnerability

Sources

Totalone very hot coffee