CVE-2026-48210

Possible information disclosure via External Interface

CVSS 5.7 MEDIUMEPSS 0.2%CWE-200 CWE-269

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

31 May 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend This issue affects OTRS 2026.3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected products

OTRS AG · OTRS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://otrs.com/release-notes/otrs-security-advisory-2026-09/