Improper Privilege Management in Zammad (CVE‑2026‑102490) Enables Local Root Escalation
What It Is — Zammad GmbH’s open‑source ticketing platform contains an improper privilege‑management flaw that allows a locally authenticated zammad user to elevate privileges to the root account. The issue can be chained with CVE‑2026‑102489 to achieve full system compromise.
Exploitability — No public exploit has been released, but the vulnerability is exploitable by any attacker with local access to the service account. The CVSS base score is 8.8 (High).
Affected Products — All self‑hosted installations of Zammad prior to the vendor‑issued patch (versions ≤ 5.2.0).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that privileged‑access controls enforce the principle of least privilege.
- Highlights gaps in audit‑ready evidence of privilege‑escalation monitoring, a key control that enterprise auditors now request.
- Underscores the importance of a defensible remediation workflow that can be surfaced in a Trust Center for third‑party risk assessments.
Recommended Actions
- Apply the vendor‑released patch for CVE‑2026‑102490 immediately.
- Review and harden the zammad service account permissions; enforce “no‑sudo” or least‑privilege profiles.
- Enable and centralize OS‑level audit logging for privilege‑escalation events; integrate logs into a continuous monitoring platform.
- Conduct a post‑patch validation to confirm that the privilege‑escalation path is closed.
Source: CISA KEV – CVE‑2026‑102490