Vulnerability · Published Jun 1, 2026 · Assigned by OTRS

CVE-2026-48191Wrong Permission Handling in Document Search Article Meta Filters

Low 3.5

In plain English

A low-severity incorrect default permissions in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This issue affects OTRS with STORM modules: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X

Affected products (as reported)

Vendor	Product	Versions
OTRS AG	OTRS	8.0.x2023.x2024.x2025.x2026.x – through 2026.3.x

Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

https://otrs.com/release-notes/otrs-security-advisory-2026-05/