{"id":"CVE-2026-102490","published":"2026-09-30T17:16:40.707","lastModified":"2026-10-03T04:18:00.460","description":"All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":["zammad","docker","linux"],"products":["zammad","docker","linux kernel"],"references":[{"url":"https://csirt.divd.nl/CVE-2026-102490","tags":["Third Party Advisory"]},{"url":"https://csirt.divd.nl/DIVD-2026-00015","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490","tags":["US Government Resource"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows the local zammad user to escalate privileges to root, enabling full control over the system.","exploitability":"Exploitation is straightforward given the necessary local user access. No preconditions are required other than being logged in as the zammad user.","blast_radius":"If exploited, the attacker could gain complete control over the system, leading to potential data loss, system compromise, and further attacks.","remediation":"Upgrade to the latest version of Zammad, ensuring it is patched against this vulnerability. Follow the specific vendor advisory for detailed instructions.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","local-privilege-escalation","zammad","root-escalation"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:44:12.683Z"}}