CVE-2026-78356
Received Received - Intake

Unauthenticated Access to OTRS Agent Frontend Configuration

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: OTRS AG

Description
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks. This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-78356
EUVD
EUVD-2026-97266

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
OTRS GmbH (former OTRS AG) OTRS 8.0.x
OTRS GmbH (former OTRS AG) OTRS 2023.x
OTRS GmbH (former OTRS AG) OTRS 2024.x
OTRS GmbH (former OTRS AG) OTRS 2025.x
OTRS GmbH (former OTRS AG) OTRS 2026.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated remote users to access internal OTRS application configuration that should only be available to authenticated agents. The exposed data includes frontend routes, authorization groups, authentication settings, enabled features, third-party integrations, and other implementation details. While it does not directly provide user credentials or allow configuration changes, it could help attackers identify potential attack vectors by fingerprinting the system.

Detection Guidance

Check if the OTRS Agent Frontend configuration endpoint is accessible without authentication by attempting to access /otrs/index.pl?Action=AdminSystemConfiguration. If it returns configuration data, the system is vulnerable.

Impact Analysis

An attacker could use the exposed configuration details to learn about your OTRS setup, identify security-relevant settings, and prepare further attacks. This increases the risk of targeted exploits against your system, even though direct damage is limited.

Compliance Impact

This vulnerability may indirectly impact compliance with GDPR and HIPAA by exposing sensitive system configuration details. GDPR requires protection of personal data and system security, while HIPAA mandates safeguarding protected health information. The exposed configuration could reveal security-relevant settings or third-party integrations that may not meet regulatory requirements.

Mitigation Strategies

Update OTRS to version 2026.7.1 or later immediately. If using OTRS 7, upgrade to a supported version as no patches will be provided.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart