Vulnerability in OTRS GmbH (former OTRS AG) OTRS

[ Description ]Official description

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund11 Oct 2026WID-SEC-2026-3872

  OTRS: Multiple vulnerabilities Translated from German

  CVE-2026-78358CVE-2026-93582CVE-2026-78357+6 more CVEs

[ References ]References

• otrs.com/release-notes/otrs-security-advisory-2026-10