All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

#!/usr/bin/env bash
# check_cve_2026_102490.sh — CVE-2026-102490 version checker
# Checks whether the local Zammad installation is in the affected version range.
# Affected: all versions >= 1.5.0 and < 7.2.0 (7.2.0 includes partial mitigations)
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

set -euo pipefail

VULNERABLE_FLOOR="1.5.0"
PATCHED_VERSION="7.2.0"

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Attempt to find Zammad version
ZAMMAD_VERSION=""

# Method 1: zammad CLI version
if command -v zammad >/dev/null 2>&1; then
  ZAMMAD_VERSION=$(zammad version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+[a-zA-Z0-9.-]*' | head -1 || true)
fi

# Method 2: Check common install paths
if [ -z "$ZAMMAD_VERSION" ]; then
  for path in /opt/zammad /usr/share/zammad /home/zammad/zammad; do
    if [ -f "$path/VERSION" ]; then
      ZAMMAD_VERSION=$(grep -oP '[0-9]+\.[0-9]+\.[0-9]+[a-zA-Z0-9.-]*' "$path/VERSION" | head -1 || true)
      break
    fi
    if [ -f "$path/lib/version.rb" ]; then
      ZAMMAD_VERSION=$(grep -oP '[0-9]+\.[0-9]+\.[0-9]+[a-zA-Z0-9.-]*' "$path/lib/version.rb" | head -1 || true)
      break
    fi
  done
fi

# Method 3: Check Docker containers
if [ -z "$ZAMMAD_VERSION" ] && command -v docker >/dev/null 2>&1; then
  CONTAINER_ID=$(docker ps --filter "name=zammad" --format '{{.ID}}' 2>/dev/null | head -1 || true)
  if [ -n "$CONTAINER_ID" ]; then
    ZAMMAD_VERSION=$(docker exec "$CONTAINER_ID" cat /opt/zammad/VERSION 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+[a-zA-Z0-9.-]*' | head -1 || true)
  fi
fi

# Method 4: Check dpkg/rpm
if [ -z "$ZAMMAD_VERSION" ]; then
  ZAMMAD_VERSION=$(dpkg-query -W -f='${Version}' zammad 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+[a-zA-Z0-9.-]*' | head -1 || true)
fi
if [ -z "$ZAMMAD_VERSION" ]; then
  ZAMMAD_VERSION=$(rpm -q --qf '%{VERSION}' zammad 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+[a-zA-Z0-9.-]*' | head -1 || true)
fi

if [ -z "$ZAMMAD_VERSION" ]; then
  echo "UNKNOWN — Could not determine Zammad version. Zammad may not be installed on this host."
  exit 2
fi

# Strip alpha/beta suffixes for version comparison
CLEAN_VERSION=$(echo "$ZAMMAD_VERSION" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')

echo "Detected Zammad version: $ZAMMAD_VERSION"

if ! version_gte "$CLEAN_VERSION" "$VULNERABLE_FLOOR"; then
  echo "UNKNOWN — Version $ZAMMAD_VERSION is below the documented affected range (>= $VULNERABLE_FLOOR) but some sources list all versions as affected. Manual review recommended."
  exit 2
elif version_gte "$CLEAN_VERSION" "$PATCHED_VERSION"; then
  echo "PATCHED — Zammad $ZAMMAD_VERSION includes partial mitigations for CVE-2026-102490 (>= $PATCHED_VERSION). Note: DIVD states full fix is still pending. Verify with vendor."
  exit 0
else
  echo "VULNERABLE — Zammad $ZAMMAD_VERSION is affected by CVE-2026-102490 (local privilege escalation to root). All versions >= $VULNERABLE_FLOOR and < $PATCHED_VERSION are vulnerable."
  exit 1
fi