Zammad DEB/RPM Package Local Privilege Escalation Advisory (CVE-2026-102490)
Executive & SecOps Summary
SECOPS ASSESSMENTZammad installations using DEB or RPM packages built via packager.io (Source and Docker excluded).
A local attacker with 'zammad' service account access can escalate to full 'root' privileges on the host.
Immediately update Zammad to the latest patched version via package manager.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDUpdate the Zammad package to the latest version using your system's package manager.
# For Debian/Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade zammad
# For RHEL/CentOS/AlmaLinux
sudo yum update zammadAs a temporary workaround, audit the file permissions in the Zammad installation directory and ensure that no files executed by root-level systemd services are writable by the 'zammad' user.
Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
The vulnerability exists due to improper privilege management (CWE-269) during the service startup sequence in DEB and RPM packages. Service processes initiate with root privileges and execute files that are owned or writable by the unprivileged 'zammad' account before dropping their identity. A local attacker who has already gained a foothold as the 'zammad' user can overwrite these files with malicious payloads. Since the affected services are configured to restart automatically whenever they stop, an attacker can trigger a privilege escalation to root within seconds without any administrator interaction.
Official Vendor Advisories & References
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.