CVE-2026-102490: Zammad packages ran as root and executed writable files

Zammad's DEB and RPM packages started services as root and executed files writable by the unprivileged zammad account before dropping privileges, enabling local privilege escalation. The flaw has a CVSS score of 7.8 and was added to CISA's Known Exploited Vulnerabilities catalog on October 2, 2026. Source and container installs were not affected.

• CVSS 3.1 base score 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 2, 2026
• All released packager.io packages affected; source and container installs unaffected
• Automatic service restarts gave repeated root execution windows