CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Other sources
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of the Zammad product if mitigations are unavailable.
Event History
Frequently Asked Questions
Which deployments are practically exploitable?
Zammad versions 6.3.0 through 6.5.4 are described as vulnerable to session hijacking that can lead to remote code execution as the zammad user. Versions 7.0.0 through 7.1.3 are also affected, but the issue is not exploitable there because of environmental conditions.
What level of access could an attacker gain?
Successful exploitation can result in remote code execution with the privileges of the zammad user.