CVE-2026-78356

Name of the Vulnerable Software and Affected Versions OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X OTRS versions prior to 2026.7.X

Description The Agent Frontend configuration endpoint can be accessed without authentication, allowing remote users to retrieve internal application configuration intended for authenticated users. The exposed data may include authentication configuration, enabled product features, third-party integration settings, configured frontend routes with their authorization groups, and other implementation details. While this does not expose user credentials or allow configuration modification, it enables attackers to fingerprint the installation and identify security-relevant settings to facilitate further attacks.

Recommendations Update OTRS version 8.0.X to a fixed version. Update OTRS version 2023.X to a fixed version. Update OTRS version 2024.X to a fixed version. Update OTRS version 2025.X to a fixed version. Update OTRS versions prior to 2026.7.X to version 2026.7.X or later.