SB2026100263 - Multiple vulnerabilities in Zammad helpdesk

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100263

SB2026100263 - Multiple vulnerabilities in Zammad helpdesk

Published: October 2, 2026

Security Bulletin ID SB2026100263
CSH Severity
Critical
Patch available
NO
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Critical 50% High 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Incorrect default permissions (CVE-ID: CVE-2026-102490) Exploited

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can gain root privileges.

Note, the vulnerability is being actively exploited in the wild.


2) Session fixation (CVE-ID: CVE-2026-102489) Exploited

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to session fixation issue. A remote attacker can hijack session of a high privileged user and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild. 


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References