Identity Management Flaw in OTRS by OTRS AG

CVE-2026-78359

What is CVE-2026-78359?

OTRS exhibits a vulnerability that fails to enforce the uniqueness of customer user identities across multiple configured backends, such as databases and LDAP. This oversight allows authenticated users with the necessary permissions to create or modify customer accounts to inadvertently create duplicate records with the same email address across different backends. As a result, critical customer-related information and email communications may be erroneously linked to the wrong customer user. The issue does not allow for the creation of customer accounts by unauthenticated users, thereby limiting the context for potential exploitation, which requires appropriate user permissions.

References