Unauthenticated Access to OTRS Agent Frontend Configuration Endpoint

CVE-2026-78356

What is CVE-2026-78356?

The OTRS Agent Frontend is vulnerable to unauthenticated access at its configuration endpoint. This flaw allows remote users, without authentication, to access sensitive internal configuration details that the system uses for managing agent interfaces. These details may include routes, authorization groups, authentication settings, enabled product features, and third-party integrations. While the retrieved information does not expose user credentials or allow for direct alterations to the configuration, it can significantly aid an attacker in profiling the system. Knowledge of the configuration can lead to targeted and effective follow-up attacks against the OTRS system.

References