CVE-2026-48190: OTRS Permission Bypass – CMDB CI Data Disclosure

Technical summary

CVE-2026-48190 stems from improper access control in OTRS's External Interface combined with the ConfigItem List module. The vulnerability enables an authenticated customer-tier user to enumerate or retrieve CI data from the CMDB in violation of intended permission boundaries. The flaw is rooted in CWE-276 (Incorrect Default Permissions), indicating the module fails to enforce group-based access restrictions properly when CustomerGroupSupport is active. Exploitation requires valid authentication credentials and user interaction; no network-only attack vector exists.

Business impact

For OTRS deployments using CMDB and CustomerGroupSupport, this vulnerability risks information disclosure of IT asset and configuration data. Customers could learn details about your infrastructure, software versions, hardware inventory, or related business systems—potentially aiding further reconnaissance or social engineering attacks. The impact is typically bounded by what CI data you expose and the sensitivity of your asset inventory, but in environments where CI data contains sensitive details (licensing, vendor info, internal system names), this poses a moderate information security concern.

Affected systems

OTRS versions 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.4.x are vulnerable. The vulnerability is conditional: it only manifests in deployments where both the CMDB module is enabled and CustomerGroupSupport is configured. Organizations running OTRS without these specific features enabled are not affected. Verify your OTRS version and configuration to determine exposure.

Exploitability

Exploitation is classified as LOW severity (CVSS 3.5) because it requires multiple preconditions: valid customer authentication, CMDB enablement, CustomerGroupSupport activation, and user interaction. An attacker cannot exploit this remotely without credentials. The access is limited to CI information and does not permit modification or system disruption. Practical attack scenarios typically involve a malicious or compromised customer account performing reconnaissance of your IT asset inventory.

Remediation

Upgrade OTRS to version 2026.4.x or later. If you cannot upgrade immediately, review and restrict CustomerGroupSupport configuration to minimize the data accessible to customer accounts, or disable the CMDB module if it is not operationally necessary. Audit customer account access logs to identify any unauthorized CI queries.

Patch guidance

Apply OTRS 2026.4.x or a later patched version as provided by the OTRS vendor. Verify the vendor security advisory for any additional configuration changes recommended alongside the patch. Test the patch in a non-production environment first to ensure compatibility with your existing OTRS customizations and integrations. If you are on version 2026.x before 2026.4.x, prioritize this update; versions 2023.x through 2025.x will likely receive a corresponding backport—check vendor advisories for availability.

Detection guidance

Monitor OTRS External Interface logs for customer-initiated ConfigItem List queries, particularly those attempting to retrieve CI data outside their assigned group scope. Use OTRS access logs to identify patterns of CI enumeration or queries for sensitive asset information. Review customer account activity around the publication date (June 2026) to establish a baseline for normal CI access and flag anomalies. Consider enabling detailed audit logging for CMDB queries if your deployment permits.

Why prioritize this

Although the CVSS score is LOW (3.5), prioritize patching in environments where CMDB contains sensitive asset or infrastructure data. Organizations using CustomerGroupSupport for multi-tenant or multi-customer segregation should treat this as medium priority because customer isolation is a core security control. The conditional nature (CMDB + CustomerGroupSupport required) means this is not a universal threat, but organizations meeting both conditions should patch in a routine maintenance cycle.

Risk score, explained

The CVSS 3.1 score of 3.5 reflects low attack complexity, requirement for prior authentication, lack of user interaction impact (though exploitation itself requires UI interaction), and confidentiality impact limited to CI data. The score does not increase due to absence of integrity or availability impact. In a multi-tenant OTRS environment where customer isolation is critical, your internal risk tolerance may warrant treating this as higher priority despite the low base score.

Frequently asked questions