What is GHSA-xmw5-m2wg-4243?

GHSA-xmw5-m2wg-4243 is a security advisory published by GitHub Security Advisories with Critical severity. Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote...

Which CVE IDs does GHSA-xmw5-m2wg-4243 cover?

GHSA-xmw5-m2wg-4243 covers the following CVE IDs: CVE-2026-102489. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xmw5-m2wg-4243?

GHSA-xmw5-m2wg-4243 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-xmw5-m2wg-4243CriticalCVSS 9.8

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-102489 →

📋 Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-102489
https://csirt.divd.nl/CVE-2026-102489
https://csirt.divd.nl/DIVD-2026-00015
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489
https://github.com/advisories/GHSA-xmw5-m2wg-4243