CVE-2026-48211
Received Received - Intake

CSRF in OTRS AdminImportExport Template Deletion

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: OTRS AG

Description
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-48211
EUVD
EUVD-2026-97263

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
OTRS GmbH (former OTRS AG) OTRS 7.0.x
OTRS GmbH (former OTRS AG) OTRS 8.0.x
OTRS GmbH (former OTRS AG) OTRS 2023.x
OTRS GmbH (former OTRS AG) OTRS 2024.x
OTRS GmbH (former OTRS AG) OTRS 2025.x
OTRS GmbH (former OTRS AG) OTRS 2026.x
OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition 6.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in OTRS where an authenticated administrator can be tricked into deleting Import/Export templates. The AdminImportExport::TemplateDelete action lacks ChallengeToken validation, allowing an unauthenticated attacker to craft malicious requests executed with admin privileges.

Detection Guidance

Detecting this CSRF vulnerability requires checking OTRS versions and monitoring for suspicious administrative actions. Verify if your OTRS version is 2026.X before 2026.7.X or any listed vulnerable versions. Check web server logs for unusual POST requests to the AdminImportExport::TemplateDelete action without a valid ChallengeToken.

Impact Analysis

An attacker could exploit this to delete critical Import/Export templates, disrupting data management workflows. This may lead to data loss, operational disruptions, or unauthorized modifications if combined with other vulnerabilities.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized deletion of administrative Import/Export templates. Unauthorized changes to data handling processes may violate data integrity requirements under these regulations.

Mitigation Strategies

Immediately update OTRS to version 2026.7.1 or later. If using OTRS 7, upgrade to a supported version as no patches will be provided. Ensure all administrative sessions are terminated after updating. Monitor for unauthorized template deletions in system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart