CVE-2026-78358: CWE-352 Cross-Site Request Forgery (CSRF) in OTRS GmbH (former OTRS AG) OTRS

Several administrative actions in OTRS do not sufficiently validate whether requests are intentionally initiated by authenticated users, specifically lacking ChallengeToken validation. The DBUpdateLogCleanUp action can be triggered via a GET request without validation, enabling an attacker to cause an authenticated administrator's browser to execute this cleanup action through CSRF. This results in deletion of existing DBUpdate log entries, reducing availability of diagnostic and audit information. Additional administrative endpoints without ChallengeToken validation can trigger actions like deploying or synchronizing existing configurations but do not allow arbitrary configuration changes via CSRF. Export and read-only endpoints also lack ChallengeToken validation but do not expose response content due to same-origin policy. Affected versions include OTRS 6.0.0 up to but not including 7.1.0, 8.0.0 up to but not including 8.1.0, and all 2023.x through 2026.6.x releases. No known exploits in the wild have been reported.

Successful exploitation allows an attacker to delete existing DBUpdate log entries via CSRF, impacting the integrity and availability of diagnostic and historical audit data. There is no confidentiality impact demonstrated. Other administrative actions triggered by CSRF do not permit arbitrary configuration changes. The impact is limited to log data existing at the time of the forged request.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious when browsing untrusted web content while authenticated to OTRS. Implementing additional CSRF protections such as validating ChallengeTokens on all administrative endpoints is recommended once patches are released.