CVE-2026-48211
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-352
Impact
Remote unauthenticated attackers can delete administrative Import/Export templates by tricking an active administrator into clicking a malicious link. This causes unauthorized data deletion and service integrity disruption within the admin session.
Root cause
The AdminImportExport::TemplateDelete endpoint fails to validate the CSRF ChallengeToken on incoming deletion requests.
Affected systems
OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and ((OTRS)) Community Edition 6.x and earlier.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Fix & remediation
Upgrade to OTRS 2026.7.X or the patched maintenance release for your branch. If immediate patching is not possible, ensure administrators log out of active sessions when not actively working and avoid clicking untrusted links while logged in.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected