CVE Feed

    Dashboard / CVE / CVE-2026-48211

    CVE-2026-48211

    An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

    Published:Oct 12, 2026
    Last Modified:Oct 15, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00117
    CVSS Score:5.4

    Affected Products

    Vendor
    Otrs
    Product
    Otrs
    Vendor
    Otrs
    Product
    Otrs Community Edition

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-93582 (CVSS 9.4) — The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated usern…
    CVE-2026-93581 (CVSS 6.1) — User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from …
    CVE-2026-78359 (CVSS 5.4) — OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured Custo…
    CVE-2026-78358 (CVSS 4.3) — Several administrative actions do not sufficiently validate whether a request was intentionally initiated by t…
    CVE-2026-78357 (CVSS 9.1) — Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user ac…
    CVE-2026-78356 (CVSS 5.3) — The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthentic…
    CVE-2026-78355 (CVSS 8.7) — A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrat…
    CVE-2026-48212 (CVSS 4.8) — An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored …
    CVE-2026-48187 (CVSS 5.7) — An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows exc…
    CVE-2026-48188 (CVSS 9.1) — An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High