All vulnerabilities
CVE-2026-48211

OTRS: Cross-Site Request Forgery in Import/Export Admin console

OTRS GmbH (former OTRS AG) OTRS
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published12 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.

This issue affects OTRS:

  • 7.0.X
  • 8.0.X
  • 2023.X
  • 2024.X
  • 2025.X
  • 2026.X before 2026.7.X

Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Text from CVE List

Affected versions 7

  • OTRSaffected: 7.0.xCVE List
  • OTRSaffected: 8.0.xCVE List
  • OTRSaffected: 2023.xCVE List
  • OTRSaffected: 2024.xCVE List
  • OTRSaffected: 2025.xCVE List
  • OTRSaffected: 2026.x through 2026.6.xCVE List
  • ((OTRS)) Community Editionaffected: 6.xCVE List

References 1