CVE-2026-48187

MediumCVSS 5.7/10Last modified Jul 22, 2026

Description

An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS:

* 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X

Please note that ((OTRS)) Community Edition 6.x, OTRS 7.x and products based on the ((OTRS)) Community Edition also very likely to be affected

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
OTRS AG	OTRS	8.0.x; 2023.x; 2024.x; 2025.x; >= 2026.x, <= 2026.3.x
OTRS AG	((OTRS)) Community Edition	—

References

https://otrs.com/release-notes/otrs-security-advisory-2026-06/Vendor Advisory

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-481889.1An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injecti CVE-2026-481895.7An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to oth CVE-2026-48196.5In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.CVE-2026-481903.5An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the CVE-2026-481913.5An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules al CVE-2026-481925.4A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.CVE-2026-481938.1Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.CVE-2026-481948.1Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.CVE-2026-481956.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows CVE-2026-481966.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows CVE-2026-481977.2Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalati CVE-2026-481997.5Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.