CVE-2026-78359: CWE-694 Use of Multiple Resources with Duplicate Identifier in OTRS GmbH (former OTRS AG) OTRS

CVE-2026-78359 is a vulnerability in OTRS where the system does not sufficiently enforce uniqueness of customer user email addresses across multiple configured CustomerUser backends such as database and LDAP. The uniqueness check is only performed within the selected backend, allowing an authenticated user with permission to create or modify customer users to create duplicate email addresses in different backends. This can lead to multiple customer user records representing the same communication identity, potentially causing customer-related information or email communication to be associated with the wrong customer user depending on workflow and backend resolution. The vulnerability affects OTRS versions 6.0.0 up to but not including 7.1.0, 7.0.0 up to but not including 7.1.0, 8.0.0 up to but not including 8.1.0, and all 2023.x through 2026.6.x versions. Exploitation requires authenticated user permissions to create or modify customer users, and does not allow unauthenticated user account creation.

The vulnerability can cause customer user records to be duplicated across backends with the same email address, leading to potential misassociation or exposure of customer-related information or email communications to incorrect users. This could impact confidentiality and integrity of customer data within the affected OTRS deployments. However, exploitation requires authenticated user permissions to create or modify customer users, limiting the attack surface. There is no indication of denial of service or unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to create or modify customer users to trusted administrators only to reduce risk. Monitor vendor communications for official patches or updates addressing this issue.