CVE-2026-48190CWE-276

Incorrect handling of permissions in External Interface Config Item List module

Low · published June 1, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affected.

This issue affects OTRS:

* 7.0.X

* 8.0.X

* 2023.X

* 2024.X

* 2025.X

* 2026.X before 2026.4.X

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-06-01T03:32Z
EPSS history
Timeline
  • 01 JUN 03:32Z
    Incorrect handling of permissions in External Interface Config Item List module
    cvelistv5