CVE-2026-78358
Received Received - Intake

CSRF in OTRS Leading to Log Deletion

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: OTRS AG

Description
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed. Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself.  Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site request, the response content remains subject to the browser's same-origin restrictions and is not automatically exposed to the attacker. Therefore, no direct confidentiality impact has been demonstrated for these endpoints. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-78358
EUVD
EUVD-2026-97268

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
OTRS GmbH (former OTRS AG) OTRS 7.0.x
OTRS GmbH (former OTRS AG) OTRS 8.0.x
OTRS GmbH (former OTRS AG) OTRS 2023.x
OTRS GmbH (former OTRS AG) OTRS 2024.x
OTRS GmbH (former OTRS AG) OTRS 2025.x
OTRS GmbH (former OTRS AG) OTRS 2026.x
OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition 6.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in OTRS where administrative actions lack proper validation. An unauthenticated attacker can trick an authenticated administrator into executing actions via crafted GET requests without a valid ChallengeToken. This can delete DBUpdate log entries, reducing diagnostic and historical data for troubleshooting and auditing.

Detection Guidance

This vulnerability is a CSRF issue in OTRS administrative actions. Detection involves checking OTRS versions against affected releases and monitoring for unauthorized administrative actions like DBUpdateLogCleanUp or configuration changes without proper token validation.

Impact Analysis

An attacker could delete existing DBUpdate log entries, removing critical diagnostic and historical information needed for troubleshooting and auditing. Some administrative actions like deploying or synchronizing configurations could also be triggered, though arbitrary new configurations cannot be introduced.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by reducing the availability of diagnostic and historical information used for troubleshooting and auditing. Deletion of DBUpdate log entries could hinder forensic investigations and breach reporting under these regulations.

Mitigation Strategies

Immediately update OTRS to version 2026.7.1 or later. If using OTRS 7, upgrade to a supported version as no patches will be provided. Review administrative logs for unauthorized actions and ensure ChallengeToken validation is enforced on all endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart