PT-2026-45263 · Otrs+1 · Otrs+1

Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-48191

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OTRS with STORM modules versions 7.0.x OTRS with STORM modules versions 8.0.x OTRS with STORM modules versions 2023.x OTRS with STORM modules versions 2024.x OTRS with STORM modules versions 2025.x OTRS with STORM modules versions prior to 2026.4.x

Description Incorrect handling of permissions in the Document Search Article Meta Filters modules allows an attacker to obtain information regarding the number of affected Configuration Items (CIs), Service Level Agreements (SLA), and services without having the required access permissions.

Recommendations Update OTRS with STORM modules versions 7.0.x to a secure version. Update OTRS with STORM modules versions 8.0.x to a secure version. Update OTRS with STORM modules versions 2023.x to a secure version. Update OTRS with STORM modules versions 2024.x to a secure version. Update OTRS with STORM modules versions 2025.x to a secure version. Update OTRS with STORM modules to version 2026.4.x or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2026-48191

Affected Products

Otrs

Storm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-48191 · Security Note
• https://t.me/CVEtracker/55437 · Telegram Post
• https://otrs.com/release-notes/otrs-security-advisory-2026-05 · Note
• https://twitter.com/VulmonFeeds/status/2061329530741002642 · Twitter Post