CVE-2026-48191 — Wrong Permission Handling in Document Search Article Meta Filters

CVE-2026-48191

Wrong Permission Handling in Document Search Article Meta Filters PUBLISHED

Description (CNA)

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This issue affects OTRS with STORM modules: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X

Affected (CNA)

Vendor / product	Versions
OTRS AG / OTRS	unknown 7.0.x; affected 8.0.x; affected 2023.x; affected 2024.x; affected 2025.x; affected 2026.x through 2026.3.x

CWE

CWE-276

References

https://otrs.com/release-notes/otrs-security-advisory-2026-05/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.