CVE-2026-78358

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x

Description Several administrative actions fail to sufficiently validate if a request was intentionally initiated by an authenticated user. Specifically, the DBUpdateLogCleanUp action can be triggered via a GET request without validating a ChallengeToken. This allows an unauthenticated remote attacker to trick an authenticated administrator's browser into executing the cleanup action through a crafted request in a malicious web page, resulting in the deletion of DBUpdate log entries. This reduces the availability of diagnostic and historical data for auditing and troubleshooting. Other administrative endpoints lacking ChallengeToken validation can trigger actions like deploying or synchronizing existing configurations, though they do not allow the introduction of new configurations. Additionally, export and read-only endpoints lack this validation, but browser same-origin restrictions prevent the response content from being exposed to the attacker.

Recommendations Update OTRS to version 2026.7.x or later.