{"id":"CVE-2026-48211","revision":"3f32573e6f41474094585808959803a0","records":[{"revision":"3f32573e6f41474094585808959803a0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48211","aliases":[],"title":"Cross-Site Request Forgery in Import/Export Admin console","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","state":0,"publishedAt":"2026-10-12T06:48:42.33+00:00","modifiedAt":"2026-10-15T18:08:04.851+00:00","affected":[{"ecosystem":"Vendor product","name":"OTRS","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"affected\",\n                    \"modules\": [\n                        \"Admin Interface\"\n                    ],\n                    \"product\": \"OTRS\",\n                    \"vendor\": \"OTRS GmbH (former OTRS AG)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"7.0.x\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"8.0.x\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2023.x\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2024.x\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2025.x\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"2026.6.x\",\n                            \"status\": \"affected\",\n                            \"version\": \"2026.x\",\n                            \"versionType\": \"patch\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"((OTRS)) Community Edition","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"affected\",\n                    \"modules\": [\n                        \"Admin Interface\"\n                    ],\n                    \"product\": \"((OTRS)) Community Edition\",\n                    \"vendor\": \"OTRS GmbH (former OTRS AG)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.x\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","score":5.4,"severity":"MEDIUM"}],"references":["https://otrs.com/release-notes/otrs-security-advisory-2026-10/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48211","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48211","identifiers":["CVE-2026-48211"]},"retained":false,"historicalAffected":[]}],"coverage":[]}