Cross-Site Scripting Vulnerability in OTRS by OTRS Group
CVE-2026-48212

4.8MEDIUM

Key Information:

Vendor

Otrs Gmbh (former Otrs Ag)

Status
Otrs
Vendor
CVE Published:
12 October 2026

What is CVE-2026-48212?

An OTRS administrator can exploit a cross-site scripting vulnerability by injecting arbitrary JavaScript into the content of an OTRS Custom Page. This malicious script is subsequently stored in the application database and executed in the browsers of users who access that page, leading to potential data theft and session hijacking.

Affected Version(s)

OTRS 7.0.x

OTRS 7.0.x

OTRS 8.0.x

References

https://otrs.com/release-notes/otrs-security-advisory-202...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Special thanks to William Bastos (@chor4o) and Samara Gama (igobysamy) for reporting this vulnerability
.