CVE-2026-48191

LowCVSS 3.5/10Last modified Jul 22, 2026

Description

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them.

This issue affects OTRS with STORM modules:

* 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-276

Affected software

VendorProductVersions
OTRS AGOTRS8.0.x; 2023.x; 2024.x; 2025.x; >= 2026.x, <= 2026.3.x

References

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-481925.4A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.CVE-2026-481938.1Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.CVE-2026-481948.1Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.CVE-2026-481956.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows CVE-2026-481966.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allowsCVE-2026-481977.2Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege EscalatiCVE-2026-481997.5Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.CVE-2026-48204.3IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. AttackerCVE-2026-482005.3Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows RetrieveCVE-2026-482017.1Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.CVE-2026-482025.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code ICVE-2026-482039.1Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side R
CVE-2026-48191: Low severity, CVSS 3.5 | Vulnix