PT-2026-45262 · Otrs · Otrs

Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-48190

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X OTRS versions prior to 2026.4.X

Description Incorrect handling of permissions in the External Interface and the ConfigItem List module allows an authenticated customer to query the system for Configuration Item (CI) information. This issue occurs when the Configuration Management Database (CMDB) is enabled and CustomerGroupSupport is used.

Recommendations Update versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and versions prior to 2026.4.X to a version that contains the fix. As a temporary mitigation, disable the CMDB or restrict the use of CustomerGroupSupport.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2026-48190

Affected Products

Otrs

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48190 · Security Note
• https://otrs.com/release-notes/otrs-security-advisory-2026-04 · Note
• https://t.me/CVEtracker/55436 · Telegram Post