An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevents users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend, constituting an exposure of sensitive information (CWE-200) and improper access control (CWE-269). The vulnerability has a CVSS 3.1 base score of 5.7, reflecting a medium severity with network attack vector, low attack complexity, required privileges, and user interaction.

The vulnerability results in unauthorized exposure of internal ticket information to external users through the External Frontend interface. Confidential information intended to remain internal may be disclosed, potentially compromising privacy or sensitive operational data. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should review and manually verify ticket visibility settings and consider restricting forwarding actions or access to the External Frontend to trusted users only. Avoid relying solely on the UI to control the visibility flag.