Preliminary research

CVE-2026-102489: Zammad Session Leak to RCE

Zach Hanley · Horizon3.ai · 7 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Unauthenticated event-class resolution reaches a base handler whose mass-assigned shared client state appears in a Ruby exception receiver, exposing authenticated sessions.

Record

Researcher

Zach Hanley

Published by

Horizon3.ai

Date

7 October 2026

Format

Advisory

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier disclosure

Tags

• ruby
• info-leak
• session-hijacking
• rce

This page is the archive's own catalogue record. The research is the work of Zach Hanley, first published at the original source. Preserved copies are kept so the citation survives its host.