CVE Feed

    Dashboard / CVE / CVE-2026-78356

    CVE-2026-78356

    The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks. This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

    Published:Oct 12, 2026
    Last Modified:Oct 15, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00283
    CVSS Score:5.3

    Affected Products

    Vendor
    Otrs
    Product
    Otrs

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-170 Web Application Fingerprinting
    CAPEC-694 System Location Discovery

    Related CVEs

    CVE-2026-93582 (CVSS 9.4) — The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated usern…
    CVE-2026-93581 (CVSS 6.1) — User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from …
    CVE-2026-78359 (CVSS 5.4) — OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured Custo…
    CVE-2026-78358 (CVSS 4.3) — Several administrative actions do not sufficiently validate whether a request was intentionally initiated by t…
    CVE-2026-78357 (CVSS 9.1) — Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user ac…
    CVE-2026-78355 (CVSS 8.7) — A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrat…
    CVE-2026-48212 (CVSS 4.8) — An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored …
    CVE-2026-48211 (CVSS 5.4) — An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross…
    CVE-2026-48187 (CVSS 5.7) — An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows exc…
    CVE-2026-48188 (CVSS 9.1) — An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High