CVE-2026-78358
MediumCVSS 4.3Summary
A CSRF vulnerability was identified in OTRS that allows an unauthenticated attacker to force an authenticated administrator's browser to execute administrative actions, such as DBUpdate log cleanup, without proper ChallengeToken validation. The attack can be performed by embedding a crafted GET request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries, reducing the availability of diagnostic and historical information used for troubleshooting and auditing.
Risk Assessment
The risk to the organization includes loss of integrity of DBUpdate log data, which may hinder incident analysis and auditing. Additionally, other administrative endpoints without ChallengeToken validation may allow unauthorized actions, such as deploying or synchronizing existing configuration, potentially leading to unwanted changes in the environment.
Recommendation
It is recommended to immediately upgrade OTRS to version 2026.7.X or later, if applicable, and to versions that include fixes for all affected versions (7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X). For ((OTRS)) Community Edition 6.x and earlier, which are vulnerable, consider migrating to a supported version or applying temporary mitigations such as additional authentication mechanisms and request validation.
Other vulnerabilities in OTRS
See all- CVE-2026-93581Medium
OTRS does not sufficiently neutralize user-controlled values that are later included in CSV exports. An attacker can inject values beginning with spreadsheet formula characters (=, +, -, @), which when the CSV file is opened in spreadsheet software may be interpreted as formulas and perform unintended actions. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and OTRS Community Edition 6.x and earlier.
- CVE-2026-78359Medium
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends (e.g., database and LDAP) are configured, the uniqueness check for customer user email addresses is performed only within the selected backend, allowing an authenticated user with permission to create or modify customer users to create a customer user whose email address is already assigned to a customer user in another backend. This can result in customer-related information or email communication being associated with or exposed to the wrong customer user. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and OTRS Community Edition 6.x and earlier.
- CVE-2026-78356Medium
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X.
- CVE-2026-78355High
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory, potentially allowing deletion of files accessible to the OTRS application process.
- CVE-2026-48212Medium
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This affects OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.
- CVE-2026-48211Medium
An authenticated administrator can be induced to delete administrative Import/Export templates through a CSRF attack. The AdminImportExport::TemplateDelete action does not validate the ChallengeToken, allowing an unauthenticated remote attacker to execute a malicious request with the privileges of an active administrator session. This affects OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X, as well as Community Edition 6.x and earlier.
- CVE-2026-78357Critical
In OTRS, previously issued authentication tokens (JWT) are not immediately invalidated when an agent or customer user account is deactivated or its password is changed. A token may remain valid until its regular expiration time, approximately 16 hours. An attacker who previously obtained a valid token can continue to access OTRS with the privileges of the affected account.
- CVE-2026-48188Critical
An improper input validation vulnerability in the database layer module of OTRS and ((OTRS)) Community Edition allows an unauthenticated SQL injection, which can lead to authentication bypass. This issue only affects systems where the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.
- CVE-2026-48209High
An improper neutralization of user-controllable input in OTRS and ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected XSS attacks via crafted request parameters. Malicious JavaScript can be executed in the context of an authenticated agent session when the crafted link is opened.
- CVE-2026-48208Medium
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).
Original NVD description (English source)
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed. Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself. Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site request, the response content remains subject to the browser's same-origin restrictions and is not automatically exposed to the attacker. Therefore, no direct confidentiality impact has been demonstrated for these endpoints. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Vulnerability data from NVD (NIST) · CISA KEV · EPSS