CVE-2026-48211: medium-severity vulnerability in OTRS
Cross-Site Request Forgery in Import/Export Admin console
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.1%
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.
This issue affects OTRS:
* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected products
OTRS GmbH (former OTRS AG) · OTRSOTRS GmbH (former OTRS AG) · ((OTRS)) Community EditionRelated CVEs — OTRS
In the same product, most dangerous first.
CVE-2026-78355HIGHPath Traversal in SendSupportBundle allows File Deletion Outside the Intended DirectoryEPSS 0.7%CVE-2026-93582CRITICALAuthentication Bypass via Spoofed Remote-User Header in HTTP Basic AuthenticationEPSS 0.4%CVE-2026-78357CRITICALInsufficient Session Revocation for JWT AuthenticationEPSS 0.3%CVE-2026-78356MEDIUMUnauthenticated Disclosure of Agent Frontend ConfigurationEPSS 0.3%CVE-2026-93581MEDIUMInsufficient Neutralization of Formula Elements in CSV ExportsEPSS 0.2%CVE-2026-78359MEDIUMDuplicate Identity / Identity Shadowing across CustomerUser backendsEPSS 0.2%