Vulnerability · Published Oct 12, 2026 · Assigned by OTRS
CVE-2026-48211Cross-Site Request Forgery in Import/Export Admin console
Medium 5.4
In plain English
A medium-severity cross-site request forgery in OTRS from OTRS GmbH (former OTRS AG). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2026-48211 |
| Ubuntu:24.04:LTS | znuny | no fix listed | UBUNTU-CVE-2026-48211 |
| Ubuntu:26.04:LTS | znuny | no fix listed | UBUNTU-CVE-2026-48211 |
| Ubuntu:26.10 | znuny | no fix listed | UBUNTU-CVE-2026-48211 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OTRS GmbH (former OTRS AG) | OTRS | 7.0.x8.0.x2023.x2024.x2025.x2026.x – through 2026.6.x |
| OTRS GmbH (former OTRS AG) | ((OTRS)) Community Edition | 6.x |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L