CVE-2026-102489
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C
Summary
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zammad GmbH | Zammad | * < 6.3.0 | unknown |
| Zammad GmbH | Zammad | 6.3.0 < 6.5.4 | affected |
| Zammad GmbH | Zammad | 7.0.0 < * | unaffected |
Weaknesses
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.