CSRF Vulnerability in OTRS Affects Multiple Versions

CVE-2026-78358

What is CVE-2026-78358?

The vulnerability in OTRS arises from insufficient validation of administrative actions initiated by authenticated users. Particularly, the DBUpdateLogCleanUp action can be inadvertently triggered via a GET request without verifying a ChallengeToken. This flaw allows an unauthenticated attacker to execute cleanup actions by embedding malicious requests within web pages viewed by authenticated administrators. Consequently, existing DBUpdate log entries may be deleted, impacting the availability of crucial diagnostic and historical data needed for auditing and troubleshooting. Additionally, various other administrative endpoints were found lacking adequate ChallengeToken validation, potentially leading to further exploitation, although they don’t allow arbitrary new configurations through CSRF requests. Export and read-only endpoints are also vulnerable but are subject to browser same-origin policies, limiting their direct confidentiality risks.

References