CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September; 7.2.2 fixes the root flaw on DEB and RPM installs

CISA added both CVE-2026-102489 and CVE-2026-102490 to its Known Exploited Vulnerabilities catalog on 2026-10-02 and describes them as chainable (CISA KEV catalog, 2026-10-02). Zammad published its own statement on 2026-10-01: exploitation of CVE-2026-102489 is "only possible on Zammad 6.5 and older, because of the runtime environment those versions use", those versions no longer receive security fixes, Zammad 7.0 and later are not affected, and the code is hardened in 7.2.0, the current stable release (Zammad, 2026-10-01). For CVE-2026-102490 Zammad says "DIVD has not given us any technical details about this vulnerability", so it cannot confirm the flaw, its scope or the affected versions, names no fix, and disputes DIVD's handling of the disclosure, citing a report to Zammad on 2026-09-24 and public scanning and disclosure on 2026-09-26 (Zammad, 2026-10-01). Zammad also says it first received a report about CVE-2026-102489 in August 2026 and analysed it then, which is before the exploitation DIVD dates to 2026-09-21, so the vendor may have known of the flaw before it was exploited (Zammad, 2026-10-01).

Zammad published its own security advisory for both CVEs on 2026-10-05 (Zammad, 2026-10-05). For CVE-2026-102490 it now says it has received DIVD's technical details and is analysing the issue as a high-priority item, assesses it as a local privilege escalation that cannot be exploited remotely on its own because an attacker would need access to the underlying server beforehand, and says the issue is related to a confirmed vulnerability in packager.io and that its team is working on a solution (Zammad, 2026-10-05). The advisory names no fixed release for it. Zammad recommends that administrators still on 6.5 or older update immediately, since those versions no longer receive security updates, and that access to the underlying server be restricted to trusted administrators (Zammad, 2026-10-05).

Zammad released 7.2.1 on 2026-10-06 as an important security update that addresses critical vulnerabilities, with no action needed for SaaS customers and an immediate upgrade advised for self-hosted installations (Zammad, 2026-10-06). The release comes with 27 security advisories published the same day, rated by Zammad as two critical, twelve high, ten medium and three low (Zammad advisory records, 2026-10-06); every affected range ends at 7.2.0 and none carries a CVE id yet (Zammad advisory records, 2026-10-06). 7.2.0, the release Zammad recommended on 2026-10-01, is therefore affected itself.

The two critical advisories: the public sign-up form accepted account fields it should have ignored, so an attacker without any account could register on an email address they did not own, have that account treated as already confirmed and add it to any organization, then read and reply to other customers' tickets in those organizations, with a second flaw letting a customer change fields of another customer's ticket in the same organization (Zammad advisory GHSA-79wh-8g2f-xj2c, 2026-10-06); and the email-verification flow established a fully authenticated session for an account that had never completed email verification and had multi-factor authentication configured, without the second factor, which needs possession of the account's verification email but no password and carries the account's permissions up to administrator (Zammad advisory GHSA-f3qr-94c2-7mx2, 2026-10-06). Among the high-rated advisories are a remote code execution through a template sanitizer bypass in automation configuration, a session identifier disclosed in an authenticated configuration response that enabled off-host session takeover, and a second-order SQL injection in ticket overview sorting (Zammad advisory records, 2026-10-06).

No source reports exploitation of any of the 27 flaws. Zammad's advisory of 2026-10-05 still says its team is working on a solution for CVE-2026-102490 and none of the 27 titles names that flaw, so whether 7.2.1 closes the exploited root escalation is not stated (Zammad, 2026-10-05; Zammad advisory records, 2026-10-06).

Horizon3 published a reverse-engineering of CVE-2026-102489 on 2026-10-07, with a proof-of-concept repository (Horizon3, 2026-10-07). Zammad keeps the state of every connected WebSocket client, including the session Cookie header, in a class-level registry that is passed to every event; a single request to the /ws WebSocket endpoint carrying the event name base makes the dispatcher instantiate an event class that has no implementation, and the resulting error message, which includes the object's full representation, is returned to the caller together with the cookies of all active users (Horizon3, 2026-10-07). With a leaked administrator session an attacker writes files into the application directory through the package installation endpoint, overrides the built-in password-reset email view with a malicious template and triggers a password reset for any user, which executes the template as the zammad user (Horizon3, 2026-10-07).

Horizon3 says it believes the privilege escalation is CVE-2026-102490, that it remains unpatched, and that it is withholding those details (Horizon3, 2026-10-07). Horizon3's write-up names no Zammad version; Zammad's advisory of 2026-10-05 says CVE-2026-102489 is exploitable only on 6.5 and earlier (Zammad, 2026-10-05).

Zammad released 7.2.2 on 2026-10-08 as an important security update that addresses a vulnerability affecting only DEB and RPM packages built with packager.io; SaaS customers need take no action and self-hosted installations are told to upgrade immediately (Zammad, 2026-10-08). Its GitHub advisory GHSA-p97w-927q-8vxq describes a local privilege escalation to root: services started as root and executed files that the unprivileged zammad account owned and could write before dropping privileges, and that account could write to the installation directory, so an attacker already running code as zammad could have reached root within seconds because the services restarted automatically whenever they stopped; installations from source or the official container images were not affected and every released packaged version was (Zammad advisory GHSA-p97w-927q-8vxq, 2026-10-08). The advisory record lists CVE-2026-102490, names 7.2.2 as the patched version and versions up to 7.2.1 as vulnerable (Zammad advisory GHSA-p97w-927q-8vxq, 2026-10-08), and DIVD's case page says Zammad has fixed the first flaw in release 7.2 and the second in release 7.2.2 (DIVD CSIRT, 2026-10-09). Zammad's advisory page of 2026-10-05 still says its team is working on a solution (Zammad, 2026-10-05), so the vendor's own pages disagree on status. Nothing changes for the code-execution flaw: it stays exploitable only on 6.5 and older, which receive no security fixes.