CVE-2026-78359
Received Received - Intake

Improper Email Uniqueness Check in OTRS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: OTRS AG

Description
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend. This can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user. The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify customer users. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-78359
EUVD
EUVD-2026-97269

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
OTRS GmbH (former OTRS AG) OTRS 7.0.x
OTRS GmbH (former OTRS AG) OTRS 8.0.x
OTRS GmbH (former OTRS AG) OTRS 2023.x
OTRS GmbH (former OTRS AG) OTRS 2024.x
OTRS GmbH (former OTRS AG) OTRS 2025.x
OTRS GmbH (former OTRS AG) OTRS 2026.x
OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition 6.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-706 The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CWE-694 The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OTRS fails to enforce unique customer user identities across multiple backends. When multiple backends like database and LDAP are configured, email uniqueness checks only apply within the selected backend. This allows an authenticated user with permissions to create or modify customer users to assign an email address already used in another backend, creating duplicate user records for the same identity. This can lead to customer information or communications being incorrectly associated with the wrong user.

Detection Guidance

Check OTRS configuration for multiple CustomerUser backends. Review logs for duplicate email addresses across backends. Verify user permissions for creating/modifying customer users. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could cause customer-related data or email communications to be incorrectly linked to the wrong user account. This may result in privacy breaches, data leaks, or miscommunication with customers. The impact depends on the affected workflow and backend resolution mechanisms in use.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR or HIPAA by exposing customer data to unauthorized parties or misrouting sensitive communications. Organizations using affected OTRS versions may face compliance risks due to potential data leaks or incorrect data handling.

Mitigation Strategies

Update OTRS to version 2026.7.1 or later. If using OTRS 7, migrate to a supported version as no patches will be provided. Review and restrict permissions for customer user modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78359. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart