Otrs2: In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administration view). (CVE-2026-50592)

CVE-2026-50592 describes a reflected XSS vulnerability in the AdminCommunicationLog component of Znuny LTS before version 6.5.21 and Znuny before version 7.3.3. This vulnerability allows an attacker with low privileges to inject malicious scripts into the communication log administration view, potentially compromising confidentiality and integrity of the affected system. The vulnerability affects multiple specific versions of the Otrs2 product as enumerated. The CVSS v3.1 base score is 6.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and partial confidentiality and integrity impacts without availability impact.

An attacker with low privileges can exploit this reflected XSS vulnerability to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality and integrity of data accessible via the AdminCommunicationLog interface. There is no impact on availability. The vulnerability requires network access and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AdminCommunicationLog interface to trusted users only and consider implementing web application firewall (WAF) rules to detect and block reflected XSS payloads targeting this component.