CVE-2026-48210
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the 'Is visible for customer' flag and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend.
Risk Assessment
Internal ticket information may become visible to customers, compromising confidentiality and potentially leading to sensitive data leakage.
Recommendation
Update OTRS to a patched version or manually adjust the configuration to allow disabling the customer visibility flag.
Other vulnerabilities in OTRS
See all- CVE-2026-48188Critical
An improper input validation vulnerability in the database layer module of OTRS and ((OTRS)) Community Edition allows an unauthenticated SQL injection, which can lead to authentication bypass. This issue only affects systems where the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.
- CVE-2026-48209High
An improper neutralization of user-controllable input in OTRS and ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected XSS attacks via crafted request parameters. Malicious JavaScript can be executed in the context of an authenticated agent session when the crafted link is opened.
- CVE-2026-48208Medium
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).
- CVE-2026-48191Low
In STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules, incorrect permission handling allows gaining knowledge about the number of affected CIs, SLA, and services without gaining access to them.
- CVE-2026-48190Low
In OTRS, the External Interface and ConfigItem List modules incorrectly handle permissions, allowing an authenticated customer to query the system for CI information. This affects only when CMDB is enabled and CustomerGroupSupport is used.
- CVE-2026-48189Medium
An improper input validation vulnerability in the OTRS Customer Backend module allows access to customer information restricted to other groups. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, but only when the CustomerGroupSupport feature is enabled.
- CVE-2026-48187Medium
An uncontrolled resource allocation vulnerability in OTRS email handling can lead to excessive resource consumption and webserver abortion. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, and likely also OTRS Community Edition 6.x and OTRS 7.x.
Original NVD description (English source)
An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend This issue affects OTRS 2026.3.1