{"id":"CVE-2026-48211","aliases":["EUVD-2026-97263","GHSA-f36p-fv5h-jf99","UBUNTU-CVE-2026-48211"],"status":"published","title":"Cross-Site Request Forgery in Import/Export Admin console","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00117,"percentile":0.01688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2026-10-12T06:48:42Z","modified":"2026-10-17T13:00:22Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.10-1","5.0.1-1","5.0.1-2","5.0.2-1","5.0.3-1","5.0.5-1","5.0.6-1","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.23-1","5.0.24-1","6.0.1-1","6.0.2-1","6.0.3-1","6.0.4-1","6.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.20-1","6.0.23-2","6.0.24-1","6.0.25-1","6.0.25-2","6.0.25-3","6.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.32-6","6.1.2-1","6.2.1-1","6.2.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"znuny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.3-1","6.5.4-1","6.5.5-1","6.5.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"znuny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.18-1","6.5.20-1","6.5.21-1","6.5.22-1","6.5.23-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"znuny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.15-2","6.5.18-1"]}],"products":[{"vendor":"otrs ag","product":"((otrs)) community edition"},{"vendor":"otrs ag","product":"otrs"},{"vendor":"otrs gmbh (former otrs ag)","product":"((otrs)) community edition"},{"vendor":"otrs gmbh (former otrs ag)","product":"otrs"}],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-10/","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48211"},{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-10"},{"url":"https://github.com/advisories/GHSA-f36p-fv5h-jf99"},{"url":"https://ubuntu.com/security/CVE-2026-48211","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48211","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-48211","title":"Cross-Site Request Forgery in Import/Export Admin console","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","status":"published","published":"2026-10-12T06:48:42.33Z","modified":"2026-10-15T18:08:04.851Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-97263","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","status":"published","published":"2026-10-12T06:48:42Z","modified":"2026-10-15T18:08:04Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:00:11.403253Z"}],"ghsa":[{"id":"GHSA-f36p-fv5h-jf99","title":"An authenticated administrator can be induced to delete administrative Import/Export templates...","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","status":"published","published":"2026-10-12T09:31:20Z","modified":"2026-10-12T09:31:29Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:13:05.860723Z"}],"nvd":[{"id":"CVE-2026-48211","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","status":"published","published":"2026-10-12T07:16:36.453Z","modified":"2026-10-15T20:38:44.05Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:56.310333Z"}],"osv":[{"id":"UBUNTU-CVE-2026-48211","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS:   *  7.0.X   *  8.0.X   *  2023.X   *  2024.X   *  2025.X   *  2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","status":"published","published":"2026-10-12T07:16:00Z","modified":"2026-10-17T13:00:22.15133775Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"}]}}