CVE-2026-48210 — Possible information disclosure via External Interface

CVE-2026-48210

Possible information disclosure via External Interface PUBLISHED

Description (CNA)

An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend This issue affects OTRS 2026.3.1

Affected (CNA)

Vendor / product	Versions
OTRS AG / OTRS	affected 2026.3.1

CWE

CWE-200, CWE-269

References

https://otrs.com/release-notes/otrs-security-advisory-2026-09/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.