CVE-2026-48191CWE-276

Wrong Permission Handling in Document Search Article Meta Filters

Low · published June 1, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them.

This issue affects OTRS with STORM modules:

* 7.0.X

* 8.0.X

* 2023.X

* 2024.X

* 2025.X

* 2026.X before 2026.4.X

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-06-01T03:32Z
EPSS history
Timeline
  • 01 JUN 03:32Z
    Wrong Permission Handling in Document Search Article Meta Filters
    cvelistv5