CVE-2026-78358

The OTRS help desk software (versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and Community Edition 6.x and earlier) is vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is the lack of ChallengeToken validation on several administrative endpoints, specifical...

CVE-2026-48211

The OTRS software is vulnerable to a Cross-Site Request Forgery (CSRF) attack in its Import/Export Admin console. The root cause is that the AdminImportExport::TemplateDelete action fails to validate the request's ChallengeToken . This allows an unauthenticated remote attacker to trick an authent...

EUVD-2026-97263

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery CSRF attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a...