Zammad Improper Privilege Management Local Privilege Escalation (CVE-2026-102490)

// Zammad privilege escalation — anomalous role/permission grants and zammad service-account abuse (CVE-2026-102490)
let zammadHosts = dynamic(["zammad", "zammad-web", "zammad-app"]);
union isfuzzy=true Syslog, LinuxAuditLog
| where TimeGenerated > ago(1d)
| where (ProcessName has_any ("ruby", "rails", "zammad", "rake") or SyslogMessage has "zammad")
| where SyslogMessage has_any ("permission", "role", "admin", "Users::Permission", "user.roles", "privilege")
    or SyslogMessage matches regex @"(?i)(grant|add).{0,20}(admin|role|permission)"
| extend Account = coalesce(column_ifexists("Acct", ""), extract(@"user[_ ]?id[=:]\s*(\d+)", 1, SyslogMessage))
| project TimeGenerated, Computer, ProcessName, Account, SyslogMessage
| sort by TimeGenerated desc

index=linux (sourcetype=linux_secure OR sourcetype=syslog OR sourcetype="zammad:production")
(process_name=ruby OR process_name=rails OR process_name=rake OR host="zammad*" OR source="*zammad*production.log")
("permission" OR "role" OR "Users::Permission" OR "user.roles" OR "admin" OR "privilege")
| rex field=_raw "(?i)user[_ ]?id[=:]\s*(?<target_user>\d+)"
| rex field=_raw "(?i)(?<action>grant|add|assign)\s+.{0,20}(?<grant_target>admin|role|permission)"
| stats count min(_time) as firstTime max(_time) as lastTime values(action) as actions values(grant_target) as targets by host, process_name, target_user
| where count > 0
| convert ctime(firstTime) ctime(lastTime)
| sort - lastTime

process where host.name like "zammad*" and 
  (process.name in ("ruby", "rails", "rake") or process.args like~ "*zammad*") and 
  process.args : ("*permission*", "*role*", "*admin*", "*Users::Permission*") and 
  not user.name in ("root", "deploy") and 
  user.name == "zammad"

SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, payload AS raw, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time 
FROM events 
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Linux%' 
AND (UTF8(payload) ILIKE '%zammad%' OR "Process Name" ILIKE '%ruby%' OR "Process Name" ILIKE '%rails%') 
AND (UTF8(payload) ILIKE '%permission%' OR UTF8(payload) ILIKE '%role%' OR UTF8(payload) ILIKE '%Users::Permission%' OR UTF8(payload) ILIKE '%admin%') 
AND (UTF8(payload) ILIKE '%grant%' OR UTF8(payload) ILIKE '%assign%' OR UTF8(payload) ILIKE '%add%') 
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*linux* OR _sourceCategory=*zammad* 
| where _raw matches /(?i)(ruby|rails|rake|zammad)/ 
| where _raw matches /(?i)(permission|role|Users::Permission|user\.roles|admin|privilege)/ 
| parse regex "(?i)user[_ ]?id[=:]\s*(?<target_user>\d+)" nodrop 
| parse regex "(?i)(?<action>grant|add|assign)\s+.{0,20}(?<grant_target>admin|role|permission)" nodrop 
| where !isBlank(action) 
| count by _sourceHost, target_user, action, grant_target 
| sort by _count desc

rule zammad_privilege_escalation_cve_2026_102490 {
  meta:
    author = "Argus Detection Platform"
    description = "Zammad improper privilege management exploitation (CVE-2026-102490)"
    cve = "CVE-2026-102490"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = /zammad/ nocase
    (
      $e.target.process.file.full_path = /ruby|rails|rake/ nocase or
      $e.target.process.command_line = /zammad/ nocase
    )
    $e.target.process.command_line = /permission|role|admin|Users::Permission/ nocase
  condition:
    $e
}

#event_simpleName=ProcessRollup2 
| in(field="FileName", values=["ruby", "rails", "rake"]) 
| CommandLine=/(?i)(permission|role|admin|Users::Permission|user\.roles)/ 
| ComputerName=/zammad/i 
| UserName=/zammad|root|deploy/i 
| groupBy([ComputerName, UserName, FileName, CommandLine], function=count()) 
| sort(field=_count, order=desc)