Skip to content
OpenAdvisories
High WID-SEC-2026-1748 8 CVEs

OTRS: Mehrere Schwachstellen

Published May 31, 2026 · Updated May 31, 2026 · de-DE

Vendor: OTRS Product: OTRS Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OTRS ausnutzen, um einen Denial of Service zu verursachen, um eine SQL Injection durchzuführen, um Informationen offenzulegen und um einen XSS Angriff durchzuführen.

Product

Das Open Ticket Request System (OTRS) ist ein Ticketsystem für Help-Desks.

Vulnerabilities 8

  • Critical 9.1
    CVE-2026-48188 Public exploit

    SQL Injection via MySQL Quote Method

    An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is config…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • High 7.1
    CVE-2026-48209

    Reflected XSS in authenticated agent context

    An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket actions. B…

    OTRS OTRS ((OTRS)) Community Edition
  • Medium 6.5
    CVE-2026-48208 Public exploit

    Denial-of-Service via SVG Rendering in Ticket

    An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when…

    OTRS OTRS ((OTRS)) Community Edition
  • Medium 5.7
    CVE-2026-48187

    Email with special content can lead to DoS

    An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.…

    OTRS OTRS ((OTRS)) Community Edition
  • Medium 5.7
    CVE-2026-48189

    Bypass DedicatedAgentToCustomerGroups Setting

    An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature has to be anabled and CustomerGroupSupport has to be used to be affected. This …

    OTRS OTRS
  • Medium 5.7
    CVE-2026-48210

    Possible information disclosure via External Interface

    An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket informati…

    OTRS OTRS
  • Low 3.5
    CVE-2026-48190

    Incorrect handling of permissions in External Interface Config Item List module

    An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affec…

    OTRS OTRS
  • Low 3.5
    CVE-2026-48191

    Wrong Permission Handling in Document Search Article Meta Filters

    An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This issue affect…

    OTRS OTRS

Revision history

  1. #1

    Initiale Fassung

References