CVE-2026-78356: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere in OTRS GmbH (former OTRS AG) OTRS
Description
CVE-2026-78356 is a medium severity vulnerability in OTRS that allows unauthenticated remote users to access the Agent Frontend configuration endpoint. This exposure reveals internal application configuration details such as frontend routes, authorization groups, authentication settings, enabled features, and third-party integrations. While no user credentials or configuration modification capabilities are exposed, the information disclosed can aid attackers in fingerprinting the system and planning further attacks. The vulnerability affects multiple OTRS versions including 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x prior to 2026.7.x.
CVSS v3.1
Score 5.3medium
Affected software
OTRS GmbH (former OTRS AG)
OTRS
pkg:github/otrs/otrsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OTRS Agent Frontend configuration endpoint is accessible without authentication, allowing unauthenticated remote users to retrieve sensitive internal configuration data intended only for authenticated agents. The exposed information includes frontend routes and their authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. This information disclosure does not include user credentials nor does it allow unauthorized modification of the OTRS configuration. However, the leaked details may facilitate attacker reconnaissance and preparation for subsequent targeted attacks. Affected versions include OTRS 8.0.0 through 8.0.x, 2023.0.0 through 2023.x, 2024.0.0 through 2024.x, 2025.0.0 through 2025.x, and 2026.0.0 through 2026.6.x. The issue is tracked as CVE-2026-78356 with a CVSS 3.1 base score of 5.3 (medium severity).
Potential Impact
The vulnerability allows unauthenticated attackers to obtain internal configuration details of the OTRS Agent Frontend, which can aid in system fingerprinting and identifying enabled features or security-relevant settings. This may increase the risk of targeted attacks but does not directly expose user credentials or allow configuration changes.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Agent Frontend configuration endpoint to authenticated users only through network controls or web server configuration. Monitor vendor communications for updates on patches or official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- OTRS
- Date Reserved
- 2026-08-24T11:29:41.427Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acc86862cdf04f6566ec702
Added to database: 10/12/2026, 07:04:38 UTC
Last enriched: 10/12/2026, 07:18:43 UTC
Last updated: 10/12/2026, 18:57:56 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.