PT-2026-45260 · Unknown+3 · Otrs Community Edition+3

Daniel Triznafor · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-48188

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.x through 2026.3.x OTRS Community Edition version 6.0.x

Description Improper input validation in the database layer module allows an unauthenticated SQL injection, which can lead to an authentication bypass. This enables attackers to impersonate any user and access all tickets and sensitive data. The issue only occurs if the MySQL/MariaDB server is configured with the NO BACKSLASH ESCAPES SQL mode.

Recommendations Update OTRS to version 2026.4 or newer. As a temporary mitigation, ensure the MySQL/MariaDB server is not running with the NO BACKSLASH ESCAPES SQL mode enabled.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-48188

Affected Products

Mariadb

Mysql Server

Otrs

Otrs Community Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48188 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2026-02 · Note
• https://twitter.com/VulmonFeeds/status/2061332090625446203 · Twitter Post
• https://twitter.com/UpwindMDR/status/2061347605527839182 · Twitter Post
• https://t.me/CVEtracker/55434 · Telegram Post