Cross-Site Request Forgery Vulnerability in OTRS by OTRS
CVE-2026-48211

5.4MEDIUM

Key Information:

Vendor

Otrs Gmbh (former Otrs Ag)

Status
Otrs
((otrs)) Community Edition
Vendor
CVE Published:
12 October 2026

What is CVE-2026-48211?

An authenticated administrator in OTRS can be tricked into deleting important Import/Export templates due to a vulnerable handling of ChallengeTokens in the AdminImportExport::TemplateDelete action. This vulnerability permits an unauthenticated attacker to issue a crafted request that executes with the permissions of an active administrator session, potentially resulting in critical administrative actions being carried out unknowingly. The flaw is present in OTRS versions 7.0.X, 8.0.X, and multiple subsequent versions, as well as in community editions that use deprecated code.

Affected Version(s)

((OTRS)) Community Edition 6.x

OTRS 7.0.x

OTRS 7.0.x

References

https://otrs.com/release-notes/otrs-security-advisory-202...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Special thanks to William Bastos (@chor4o) and Samara Gama (igobysamy) for reporting this vulnerability
.