CVE-2026-48190lowCWE-276

CVE-2026-48190: low-severity vulnerability in OTRS

Incorrect handling of permissions in External Interface Config Item List module

Published

Follow this CVE+ Monitor OTRS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.5epss 0.1%
An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affected. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected products
OTRS AG · OTRS
Related CVEs — OTRS

In the same product, most dangerous first.

CVE-2020-1772MEDIUMInformation DisclosureEPSS 1.6%CVE-2020-1773HIGHSession / Password / Password token leakEPSS 1.5%CVE-2020-1765LOWSpoofing of From field in several screensEPSS 1.5%CVE-2021-36100MEDIUMAuthenticated remote code executionEPSS 1.3%CVE-2021-21435MEDIUMInformation exposure in PDF exportEPSS 1.3%CVE-2020-1770LOWInformation disclosure in support bundle filesEPSS 1.3%