Vulnerability · Published Jun 1, 2026 · Assigned by OTRS

CVE-2026-48190Incorrect handling of permissions in External Interface Config Item List module

Low 3.5

In plain English

A low-severity incorrect default permissions in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affected. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X

Affected products (as reported)

Vendor	Product	Versions
OTRS AG	OTRS	7.0.x8.0.x2023.x2024.x2025.x2026.x – through 2026.3.x

Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

https://otrs.com/release-notes/otrs-security-advisory-2026-04/