CVE-2026-93582 is an authentication bypass vulnerability in OTRS Community Edition versions 6.0.0 up to but not including 7.0.0. The issue arises because HTTP Basic Authentication modules accept the authenticated username from the HTTP_REMOTE_USER environment variable, which can be controlled by an attacker via crafted HTTP headers. This allows an unauthenticated attacker to impersonate any existing user without knowing their password, potentially accessing or modifying sensitive data with that user's privileges. OTRS 7 and later are not affected due to architectural changes and additional validation mechanisms.
CVE-2026-93581 is a vulnerability in OTRS software where user-controlled input is not properly neutralized in CSV exports. This allows attackers to inject spreadsheet formula characters into CSV files, which may be interpreted as formulas when opened in spreadsheet applications. Exploitation requires the victim to open the CSV file and potentially confirm security warnings. The vulnerability affects multiple OTRS versions prior to 2026.7.X and does not involve code execution on the server side.
OTRS suffers from a vulnerability where customer user identities are not enforced as unique across multiple configured CustomerUser backends. This allows an authenticated user with permission to create or modify customer users to create duplicate customer user records with the same email address in different backends. This can lead to customer-related information or email communications being associated with the wrong customer user. The vulnerability affects multiple OTRS versions prior to 2026.7.X and requires authenticated user permissions to exploit.
CVE-2026-78358 is a Cross-Site Request Forgery (CSRF) vulnerability in OTRS versions 6.x through 8.x and 2023.x through 2026.6.x. It allows unauthenticated remote attackers to cause an authenticated administrator's browser to perform unintended administrative actions, such as deleting DBUpdate log entries, by embedding crafted requests in malicious web pages. The vulnerability affects several administrative and export endpoints that do not validate ChallengeTokens, but no direct confidentiality impact has been demonstrated. The impact is limited to the deletion of existing DBUpdate log entries, potentially reducing availability of diagnostic and audit information.
CVE-2026-78357 is a critical vulnerability in OTRS software where previously issued authentication tokens (JWTs) are not invalidated immediately after a user account is deactivated or its password is changed. This allows an attacker with a previously obtained valid token to continue accessing the system with the privileges of the affected user until the token expires, which can be about 16 hours. The impact depends on the permissions of the compromised token, with agent tokens potentially granting broad access. The vulnerability affects multiple OTRS versions prior to 2026.7.X.
CVE-2026-78356 is a vulnerability in OTRS that allows unauthenticated remote users to access the Agent Frontend configuration endpoint. This exposure reveals internal application configuration details intended only for authenticated users, such as frontend routes, authorization groups, authentication settings, enabled features, and third-party integrations. The disclosed information does not include user credentials nor allow unauthorized configuration changes but may aid attackers in fingerprinting the system and planning further attacks. The issue affects multiple OTRS versions including 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.7.x.
CVE-2026-78355 is a path traversal vulnerability in the OTRS SendSupportBundle functionality that allows an authenticated administrator to reference file paths outside the intended directory. This can lead to deletion of files accessible to the OTRS application process within the permissions of the web server or OTRS user. The vulnerability affects multiple OTRS versions prior to 2026.7.X. Exploitation requires valid administrative access, and direct arbitrary file disclosure to attackers has not been demonstrated.
CVE-2026-48212 is a stored cross-site scripting (XSS) vulnerability in OTRS software that allows an administrator to inject arbitrary JavaScript into custom pages. This script is then executed in the browsers of users who access those pages. The vulnerability affects multiple versions of OTRS, including 7.0.x, 8.0.x, and yearly releases from 2023 through 2026 prior to 2026.7.x. The CVSS score is 4.8, indicating a medium severity level.
CVE-2026-48211 is a Cross-Site Request Forgery (CSRF) vulnerability in OTRS software versions 6.0.0 through 2026.6.x. It allows an unauthenticated remote attacker to trick an authenticated administrator into deleting administrative Import/Export templates by exploiting the lack of ChallengeToken validation in the AdminImportExport::TemplateDelete action.