CVE-2026-93581 Insufficient Neutralization of Formula Elements in CSV Exports

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

EUVD-2026-97270

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

CVE-2026-93581

The OTRS help desk software (versions 7.0.X , 8.0.X , 2023.X , 2024.X , 2025.X , and 2026.X before 2026.7.X ) is vulnerable to CWE-1236 due to insufficient neutralization of formula elements in CSV exports . An attacker can inject values starting with characters like =, +, -, or @ through user in...

EUVD-2026-97269

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend...

CVE-2026-78359 Duplicate Identity / Identity Shadowing across CustomerUser backends

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend...

CVE-2026-78359

OTRS versions 7.0.X , 8.0.X , 2023.X , 2024.X , 2025.X , and 2026.X before 2026.7.X , as well as Community Edition 6.x and before , are vulnerable to Identity Shadowing . The root cause is that OTRS fails to enforce unique customer user email addresses across multiple configured backends (e.g., a...

EUVD-2026-97268

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...

CVE-2026-78358 Cross-Site Request Forgery in Administrative Actions

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...

CVE-2026-78358

The OTRS help desk software (versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and Community Edition 6.x and earlier) is vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is the lack of ChallengeToken validation on several administrative endpoints, specifical...

EUVD-2026-97267

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

CVE-2026-78357 Insufficient Session Revocation for JWT Authentication

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

CVE-2026-78357

The OTRS helpdesk software versions 7.0.X , 8.0.X , 2023.X , 2024.X , 2025.X , and 2026.X before 2026.7.X are vulnerable to insufficient session revocation for JWT authentication . The root cause is that authentication tokens are not immediately invalidated when a user account is deactivated or a...

CVE-2026-78356

The OTRS application is vulnerable to an unauthenticated disclosure of the Agent Frontend configuration. This flaw allows remote users to access an endpoint without authentication, retrieving internal details such as frontend routes , authorization groups , authentication configurations , enabled...

EUVD-2026-97266

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

CVE-2026-78356 Unauthenticated Disclosure of Agent Frontend Configuration

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

CVE-2026-78355 Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...

CVE-2026-78355

A path traversal vulnerability exists in the OTRS SendSupportBundle functionality, allowing an authenticated administrator to reference file paths outside the intended directory. This flaw enables the deletion of files accessible to the OTRS application process, subject to operating system file p...

EUVD-2026-97265

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...

CVE-2026-48212 Stored XSS in external pages

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2026-48212

An Stored XSS vulnerability exists in OTRS (versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X). An administrator can inject arbitrary JavaScript into the content of an OTRS Custom Page . The application stores this malicious script, which is then executed in the browser of...