CVE-2026-48211

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x

Description An authenticated administrator can be induced to delete administrative Import/Export templates via a Cross-Site Request Forgery (CSRF) attack. This occurs because the AdminImportExport::TemplateDelete action fails to validate the ChallengeToken, enabling an unauthenticated remote attacker to execute a malicious request using the privileges of an active administrator session.

Recommendations Update OTRS versions 6.x and earlier to a patched version. Update OTRS versions 7.0.x through 2026.6.x to version 2026.7.x or later.