CVE-2026-48209
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An improper neutralization of user-controllable input in OTRS and ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected XSS attacks via crafted request parameters. Malicious JavaScript can be executed in the context of an authenticated agent session when the crafted link is opened.
Risk Assessment
Attackers can hijack agent sessions, steal data, or perform unauthorized actions in the ticketing system, compromising data confidentiality and integrity.
Recommendation
Immediately update OTRS to version 7.0.x with the fix or apply available security patches. For versions 6.x and older, migrate to a supported version.
Other vulnerabilities in OTRS
See all- CVE-2026-48188Critical
An improper input validation vulnerability in the database layer module of OTRS and ((OTRS)) Community Edition allows an unauthenticated SQL injection, which can lead to authentication bypass. This issue only affects systems where the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.
- CVE-2026-48208Medium
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).
- CVE-2026-48191Low
In STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules, incorrect permission handling allows gaining knowledge about the number of affected CIs, SLA, and services without gaining access to them.
- CVE-2026-48190Low
In OTRS, the External Interface and ConfigItem List modules incorrectly handle permissions, allowing an authenticated customer to query the system for CI information. This affects only when CMDB is enabled and CustomerGroupSupport is used.
- CVE-2026-48189Medium
An improper input validation vulnerability in the OTRS Customer Backend module allows access to customer information restricted to other groups. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, but only when the CustomerGroupSupport feature is enabled.
- CVE-2026-48187Medium
An uncontrolled resource allocation vulnerability in OTRS email handling can lead to excessive resource consumption and webserver abortion. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, and likely also OTRS Community Edition 6.x and OTRS 7.x.
- CVE-2026-48210Medium
An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the 'Is visible for customer' flag and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend.
Original NVD description (English source)
An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket actions. By injecting malicious JavaScript into manipulated request URLs, attackers can execute arbitrary script code in the context of an authenticated agent session when the crafted link is opened. This issue affects OTRS: * 7.0.x Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected