CVE-2026-78356

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details.

The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks.

This issue affects OTRS:

* 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-783579.1Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its pa CVE-2026-783584.3Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In part CVE-2026-783595.4OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multipl CVE-2026-78363.1An incorrect calculation in the hextoint macro in Netatalk 2.0.0 through 4.4.2 due to improper uppercase character handling allows a remote CVE-2026-783619.1The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its f CVE-2026-783629.8The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing CVE-2026-783634.8The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those v CVE-2026-783643.5The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin CVE-2026-783659.3Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticate CVE-2026-783677.0A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools CVE-2026-783698.8RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administr CVE-2026-78373.7A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operat