CVE-2026-48210

Possible information disclosure via External Interface

State: Published
Severity: 5.7 Medium
Published: May 31, 2026
Updated: Jun 1, 2026
Reserved: May 21, 2026

Description

An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend

This issue affects OTRS 2026.3.1

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N	OTRS

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-269 Improper Privilege Management

Affected Products

Product	Versions
OTRSOTRS AG	2026.3.1Affected

References

https://otrs.com/release-notes/otrs-security-advisory-2026-09/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.