The vulnerability exists in Zammad packages built with packager.io (DEB and RPM). A local attacker who can write to the filesystem as the unprivileged zammad service account can gain full root privileges on the host. Service processes run briefly as root and execute files owned by the zammad account before dropping back to that account, and they automatically restart after stopping, allowing an attacker to elevate within seconds without administrator intervention. Only installations from the DEB or RPM packages are affected; source or container builds are safe. All released packaged versions are vulnerable.

Only the DEB and RPM package installations of Zammad are affected, because they use packager.io. Source builds and official container images are not vulnerable. The vendor has not supplied a more specific version list, so any installed DEB or RPM release should be treated as vulnerable until a fix is applied.

The CVSS score of 9.4 indicates a high-risk flaw. The EPSS score is less than 1%, indicating a low probability of exploitation, yet the severity rating suggests that a local attacker with access can exploit this vulnerability. Because the flaw is purely local, the attack vector is inferred to be a local user; no network or remote exploitation path is disclosed by the description. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, underscoring the need for urgent remediation.