CVE-2026-78359
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-694, CWE-706
Impact
Authenticated users with customer management permissions can access or divert sensitive customer ticket communications by registering duplicate email addresses across backends. They must already have privileges to create or edit customer users in OTRS.
Root cause
Email uniqueness validation runs only within the targeted backend rather than globally across all configured customer user backends.
Affected systems
OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and ((OTRS)) Community Edition 6.x and earlier.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade OTRS to version 2026.7.X or later. If patching immediately is not possible, restrict customer user creation and edit permissions to trusted administrators and avoid using multiple customer backends with overlapping email domains.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend. This can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user. The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify customer users. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected