CVE-2026-102489 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Zammad sites for it with a live exploit check.
Detects Zammad helpdesk installations that hand their live list of connected clients, session cookies included, to anyone who can open a websocket. In versions 6.3.0 through 6.5.4 the websocket server passes the whole connected-client registry into every event handler, and it returns the raw text of any exception that handler throws straight back to the caller. Asking for the event named base selects the abstract handler class, which has no run method, so Ruby raises an error whose text includes a dump of the handler object and with it the registry: every live connection's handshake headers, Cookie header and all. An attacker replays a harvested cookie against the REST API or through the login websocket event, which accepts a session id verbatim, and inherits that user's session. An administrator session then reaches code execution as the zammad user. The verifier opens one unauthenticated websocket carrying a freshly minted per-scan marker cookie, sends the single base event, and confirms the reply carries the registry with that marker read back out of it. A control event that resolves to no handler class comes back through the same error envelope with nothing attached, so the finding is the leak and not merely an endpoint that answers errors. CVSS 9.8, CISA KEV, exploited in the wild. Upgrade to Zammad 7.2.0 or later and invalidate every active session.
Is your app exploitable through CVE-2026-102489?
Scan your domain free