The vulnerability identified as CVE-2026-48191 stems from improper handling of permissions in the STORM powered by OTRS and OTRS Document Search Article Meta Filters modules. Affected versions include OTRS 7.0.x, 8.0.x, and all 2023.x through 2026.x versions prior to 2026.4.x. The issue permits users with some level of access (low privileges) to infer or gain knowledge about the quantity of affected CIs, SLAs, and services without having explicit access rights to these resources. This is classified under CWE-276 (Incorrect Default Permissions). The CVSS v3.1 base score is 3.5, reflecting a low severity impact primarily due to limited confidentiality impact and no integrity or availability impact. No known exploits are reported in the wild, and no official patch or remediation level has been provided by the vendor as of the publication date.

The impact of this vulnerability is limited to information disclosure of metadata related to affected Configuration Items, SLAs, and services. It does not allow unauthorized access to the actual data or modification of system resources. There is no impact on data integrity or system availability. The confidentiality impact is low, and the vulnerability requires low privileges and user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by OTRS AG, users should monitor vendor communications for updates. Until a patch is available, review and tighten permission configurations on the affected modules to restrict access to sensitive metadata where possible.