CVE-2026-78356 Details
Description
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks. This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
A vulnerability exists in the OTRS Agent Frontend configuration endpoint, which can be accessed without authentication. This flaw allows unauthenticated remote users to retrieve internal application configuration meant for authenticated users. The exposed information may include frontend routes, authorization groups, authentication settings, enabled product features, third-party integration details, and other implementation specifics. While the disclosed configuration does not contain user credentials or allow unauthorized modifications, it could aid an attacker in fingerprinting the OTRS installation and identifying functionalities or security-related settings for further attacks. This issue affects OTRS versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X prior to 2026.7.X.
Users are advised to update to OTRS version 2026.7.1 or later. Note that there will be no patches for OTRS version 7.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://otrs.com/release-notes/otrs-security-advisory-2026-13/ | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OTRS | ~8.0 ~2023 ~2024 ~2025 ~2026 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |