TI-2026-70865 Aliases CVE-2026-78356 GHSA-8jjm-2gpw-mmqf

Unauthenticated disclosure of OTRS Agent Frontend configuration

LOW 30CWE-497Published 2026-10-12 · Updated 2026-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-497.

Summary

OTRS versions 8.0.X, 2023.X, 2024.X, 2025.X and 2026.X before 2026.7.X allow the Agent Frontend configuration endpoint to be accessed without authentication. An unauthenticated remote attacker can retrieve internal configuration meant for authenticated agents, including frontend routes, authentication settings, enabled features and third-party integration settings. The exposed data contains no user credentials and does not allow changes to the configuration, but it can help an attacker fingerprint the installation and prepare further attacks (CWE-497).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks. This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00283 20th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OTRS GmbH (former OTRS AG)	OTRS	8.0.x; 2023.x; 2024.x; 2025.x; 2026.x – 2026.6.x	—	No fix listed	CNA

OTRS VendorOTRS GmbH (former OTRS AG) Affected 8.0.x; 2023.x; 2024.x; 2025.x; 2026.x – 2026.6.x Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for OTRS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-12 Threatist record created from CVE-2026-78356
2026-10-12 Alias added: GHSA-8jjm-2gpw-mmqf
2026-10-16 CISA SSVC decision points changed

References

Other 1

https://otrs.com/release-notes/otrs-security-advisory-2026-13/

TI-2026-70873 Authentication bypass via spoofed Remote-User header in OTRS CVSS 3.1CRITICAL 9.4
TI-2026-70866 Insufficient session revocation in OTRS lets old tokens stay valid CVSS 3.1CRITICAL 9.1
TI-2026-70864 Path traversal in OTRS SendSupportBundle allows file deletion CVSS 3.1HIGH 8.7
TI-2026-70872 Formula injection in OTRS CSV exports CVSS 3.1MEDIUM 6.1
TI-2026-70868 Duplicate customer identities across backends in OTRS CVSS 3.1MEDIUM 5.4
TI-2026-70862 Cross-site request forgery in OTRS Import/Export admin console CVSS 3.1MEDIUM 5.4

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences