Search
Find a vulnerability
Search criteria
6 vulnerabilities found for Zammad by Zammad GmbH
CVE-2026-102490 (GCVE-0-2026-102490)
Vulnerability from nvd – Published: 2026-09-30 16:21 – Updated: 2026-09-30 16:21Title
Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha
Summary
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/DIVD-2026-00015 | third-party-advisory |
| https://csirt.divd.nl/CVE-2026-102490 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zammad GmbH | Zammad |
Affected:
1.5.0 , < 7.1.0-alpha
(semver)
Unknown: * , < 1.5.0 (semver) |
Date Public
2026-09-29 20:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Docker"
],
"product": "Zammad",
"vendor": "Zammad GmbH",
"versions": [
{
"lessThan": "7.1.0-alpha",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"lessThan": "1.5.0",
"status": "unknown",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Earth Grob (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Luke paris (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Tijmen van der Spijk (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Zohar Cochavi (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Alje Woltjer (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Mischa Rick van Geelen (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Ralph Horn (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Max van der Horst (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Victor Pasman (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Frank Breedijk (DIVD)"
}
],
"datePublic": "2026-09-29T20:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
}
],
"value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Chained with CVE-2026-102489"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:21:20.601Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/DIVD-2026-00015"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2026-102490"
}
],
"source": {
"advisory": "DIVD-2026-00015",
"discovery": "INTERNAL"
},
"title": "Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2026-102490",
"datePublished": "2026-09-30T16:21:20.601Z",
"dateReserved": "2026-09-29T09:46:12.490Z",
"dateUpdated": "2026-09-30T16:21:20.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102489 (GCVE-0-2026-102489)
Vulnerability from nvd – Published: 2026-09-30 16:21 – Updated: 2026-09-30 16:21Title
Undisclosed RCE in Zammad v6.3 and higher
Summary
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/DIVD-2026-00015 | third-party-advisory |
| https://csirt.divd.nl/CVE-2026-102489 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zammad GmbH | Zammad |
Unknown:
* , < 6.3.0
(semver)
Affected: 6.3.0 , < 6.5.4 (semver) Unaffected: 7.0.0 , < * (semver) |
Date Public
2026-09-29 20:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Docker"
],
"product": "Zammad",
"vendor": "Zammad GmbH",
"versions": [
{
"lessThan": "6.3.0",
"status": "unknown",
"version": "*",
"versionType": "semver"
},
{
"lessThan": "6.5.4",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Earth Grob (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Luke paris (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Tijmen van der Spijk (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Zohar Cochavi (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Alje Woltjer (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Mischa Rick van Geelen (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Ralph Horn (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Max van der Horst (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Victor Pasman (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Frank Breedijk (DIVD)"
}
],
"datePublic": "2026-09-29T20:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions."
}
],
"value": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Chained with CVE-2026-102490"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:21:19.937Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/DIVD-2026-00015"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2026-102489"
}
],
"source": {
"advisory": "DIVD-2026-00015",
"discovery": "INTERNAL"
},
"title": "Undisclosed RCE in Zammad v6.3 and higher",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2026-102489",
"datePublished": "2026-09-30T16:21:19.937Z",
"dateReserved": "2026-09-29T09:46:12.490Z",
"dateUpdated": "2026-09-30T16:21:19.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-1010018 (GCVE-0-2019-1010018)
Vulnerability from nvd – Published: 2019-07-16 12:35 – Updated: 2024-08-05 03:07
VLAI
EPSS
VEX
Summary
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
Severity
No CVSS data available.
CWE
- CWE-80 - Cross Site Scripting (XSS) - CWE-80
References
3 references
| URL | Tags |
|---|---|
| https://github.com/zammad/zammad/compare/ea50d0c.… | x_refsource_MISC |
| https://github.com/zammad/zammad/compare/5c983f6.… | x_refsource_MISC |
| https://github.com/zammad/zammad/issues/1869 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zammad GmbH | Zammad |
Affected:
≤ 2.3.0 [fixed: 2.3.1
Affected: 2.2.2 and 2.1.3] |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:07:18.312Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zammad/zammad/compare/ea50d0c...238784d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zammad/zammad/issues/1869"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Zammad",
"vendor": "Zammad GmbH",
"versions": [
{
"status": "affected",
"version": "\u2264 2.3.0 [fixed: 2.3.1"
},
{
"status": "affected",
"version": "2.2.2 and 2.1.3]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Cross Site Scripting (XSS) - CWE-80",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-16T12:35:14.000Z",
"orgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
"shortName": "dwf"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zammad/zammad/compare/ea50d0c...238784d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zammad/zammad/issues/1869"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-assign@distributedweaknessfiling.org",
"ID": "CVE-2019-1010018",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Zammad",
"version": {
"version_data": [
{
"version_value": "\u2264 2.3.0 [fixed: 2.3.1"
},
{
"version_value": "2.2.2 and 2.1.3]"
}
]
}
}
]
},
"vendor_name": "Zammad GmbH"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) - CWE-80"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zammad/zammad/compare/ea50d0c...238784d",
"refsource": "MISC",
"url": "https://github.com/zammad/zammad/compare/ea50d0c...238784d"
},
{
"name": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d",
"refsource": "MISC",
"url": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d"
},
{
"name": "https://github.com/zammad/zammad/issues/1869",
"refsource": "MISC",
"url": "https://github.com/zammad/zammad/issues/1869"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
"assignerShortName": "dwf",
"cveId": "CVE-2019-1010018",
"datePublished": "2019-07-16T12:35:14.000Z",
"dateReserved": "2019-03-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:07:18.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-102490 (GCVE-0-2026-102490)
Vulnerability from cvelistv5 – Published: 2026-09-30 16:21 – Updated: 2026-09-30 16:21Title
Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha
Summary
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/DIVD-2026-00015 | third-party-advisory |
| https://csirt.divd.nl/CVE-2026-102490 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zammad GmbH | Zammad |
Affected:
1.5.0 , < 7.1.0-alpha
(semver)
Unknown: * , < 1.5.0 (semver) |
Date Public
2026-09-29 20:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Docker"
],
"product": "Zammad",
"vendor": "Zammad GmbH",
"versions": [
{
"lessThan": "7.1.0-alpha",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"lessThan": "1.5.0",
"status": "unknown",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Earth Grob (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Luke paris (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Tijmen van der Spijk (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Zohar Cochavi (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Alje Woltjer (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Mischa Rick van Geelen (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Ralph Horn (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Max van der Horst (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Victor Pasman (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Frank Breedijk (DIVD)"
}
],
"datePublic": "2026-09-29T20:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
}
],
"value": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Chained with CVE-2026-102489"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:21:20.601Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/DIVD-2026-00015"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2026-102490"
}
],
"source": {
"advisory": "DIVD-2026-00015",
"discovery": "INTERNAL"
},
"title": "Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2026-102490",
"datePublished": "2026-09-30T16:21:20.601Z",
"dateReserved": "2026-09-29T09:46:12.490Z",
"dateUpdated": "2026-09-30T16:21:20.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102489 (GCVE-0-2026-102489)
Vulnerability from cvelistv5 – Published: 2026-09-30 16:21 – Updated: 2026-09-30 16:21Title
Undisclosed RCE in Zammad v6.3 and higher
Summary
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/DIVD-2026-00015 | third-party-advisory |
| https://csirt.divd.nl/CVE-2026-102489 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zammad GmbH | Zammad |
Unknown:
* , < 6.3.0
(semver)
Affected: 6.3.0 , < 6.5.4 (semver) Unaffected: 7.0.0 , < * (semver) |
Date Public
2026-09-29 20:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Docker"
],
"product": "Zammad",
"vendor": "Zammad GmbH",
"versions": [
{
"lessThan": "6.3.0",
"status": "unknown",
"version": "*",
"versionType": "semver"
},
{
"lessThan": "6.5.4",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Earth Grob (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Luke paris (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Tijmen van der Spijk (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Zohar Cochavi (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Alje Woltjer (Merlon Security)"
},
{
"lang": "en",
"type": "finder",
"value": "Mischa Rick van Geelen (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Ralph Horn (DIVD)"
},
{
"lang": "en",
"type": "finder",
"value": "Max van der Horst (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Victor Pasman (DIVD)"
},
{
"lang": "en",
"type": "analyst",
"value": "Frank Breedijk (DIVD)"
}
],
"datePublic": "2026-09-29T20:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions."
}
],
"value": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "ATTACKED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Chained with CVE-2026-102490"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:21:19.937Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/DIVD-2026-00015"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2026-102489"
}
],
"source": {
"advisory": "DIVD-2026-00015",
"discovery": "INTERNAL"
},
"title": "Undisclosed RCE in Zammad v6.3 and higher",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2026-102489",
"datePublished": "2026-09-30T16:21:19.937Z",
"dateReserved": "2026-09-29T09:46:12.490Z",
"dateUpdated": "2026-09-30T16:21:19.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-1010018 (GCVE-0-2019-1010018)
Vulnerability from cvelistv5 – Published: 2019-07-16 12:35 – Updated: 2024-08-05 03:07
VLAI
EPSS
VEX
Summary
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
Severity
No CVSS data available.
CWE
- CWE-80 - Cross Site Scripting (XSS) - CWE-80
References
3 references
| URL | Tags |
|---|---|
| https://github.com/zammad/zammad/compare/ea50d0c.… | x_refsource_MISC |
| https://github.com/zammad/zammad/compare/5c983f6.… | x_refsource_MISC |
| https://github.com/zammad/zammad/issues/1869 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zammad GmbH | Zammad |
Affected:
≤ 2.3.0 [fixed: 2.3.1
Affected: 2.2.2 and 2.1.3] |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:07:18.312Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zammad/zammad/compare/ea50d0c...238784d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zammad/zammad/issues/1869"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Zammad",
"vendor": "Zammad GmbH",
"versions": [
{
"status": "affected",
"version": "\u2264 2.3.0 [fixed: 2.3.1"
},
{
"status": "affected",
"version": "2.2.2 and 2.1.3]"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Cross Site Scripting (XSS) - CWE-80",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-16T12:35:14.000Z",
"orgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
"shortName": "dwf"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zammad/zammad/compare/ea50d0c...238784d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zammad/zammad/issues/1869"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-assign@distributedweaknessfiling.org",
"ID": "CVE-2019-1010018",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Zammad",
"version": {
"version_data": [
{
"version_value": "\u2264 2.3.0 [fixed: 2.3.1"
},
{
"version_value": "2.2.2 and 2.1.3]"
}
]
}
}
]
},
"vendor_name": "Zammad GmbH"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) - CWE-80"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zammad/zammad/compare/ea50d0c...238784d",
"refsource": "MISC",
"url": "https://github.com/zammad/zammad/compare/ea50d0c...238784d"
},
{
"name": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d",
"refsource": "MISC",
"url": "https://github.com/zammad/zammad/compare/5c983f6...1a9af7d"
},
{
"name": "https://github.com/zammad/zammad/issues/1869",
"refsource": "MISC",
"url": "https://github.com/zammad/zammad/issues/1869"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
"assignerShortName": "dwf",
"cveId": "CVE-2019-1010018",
"datePublished": "2019-07-16T12:35:14.000Z",
"dateReserved": "2019-03-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T03:07:18.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}