CVE-2026-78356: falha de média gravidade em OTRS
Unauthenticated Disclosure of Agent Frontend Configuration
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details.
The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks.
This issue affects OTRS:
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.7.X
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
OTRS GmbH (former OTRS AG) · OTRSCVEs relacionadas — OTRS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-78355HIGHPath Traversal in SendSupportBundle allows File Deletion Outside the Intended DirectoryEPSS 0.7%CVE-2026-93582CRITICALAuthentication Bypass via Spoofed Remote-User Header in HTTP Basic AuthenticationEPSS 0.4%CVE-2026-78357CRITICALInsufficient Session Revocation for JWT AuthenticationEPSS 0.3%CVE-2026-93581MEDIUMInsufficient Neutralization of Formula Elements in CSV ExportsEPSS 0.2%CVE-2026-78359MEDIUMDuplicate Identity / Identity Shadowing across CustomerUser backendsEPSS 0.2%CVE-2026-48212MEDIUMStored XSS in external pagesEPSS 0.1%