CVE-2026-48211: CWE-352 Cross-Site Request Forgery (CSRF) in OTRS GmbH (former OTRS AG) OTRS

This vulnerability arises because the AdminImportExport::TemplateDelete action in OTRS does not validate the request's ChallengeToken, which is intended to protect against CSRF attacks. As a result, an attacker can craft a malicious request that executes with the privileges of an active administrator session, causing deletion of administrative Import/Export templates. The flaw affects OTRS versions 6.0.0 up to but not including 7.1.0, 8.0.0 up to but not including 8.1.0, and yearly versions from 2023.0.0 up to but not including 2026.7.x. The vulnerability is identified as CWE-352 and has a CVSS 3.1 base score of 5.4, indicating medium severity.

An attacker can cause an authenticated administrator to unknowingly delete administrative Import/Export templates, potentially disrupting administrative operations. The vulnerability does not allow direct privilege escalation or confidentiality breaches but can impact integrity and availability of administrative configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious when interacting with untrusted web content while logged into OTRS. Implementing additional CSRF protections or restricting administrative interface access may reduce risk.