OTRS CVE-2026-48187

Exploitation requires a valid OTRS account with at least low-level privileges (confirmed by PR:L in the CVSS vector), ruling out unauthenticated remote exploitation. User interaction is required (UI:R in CVSS), meaning the vulnerability is triggered via a user-initiated action within the OTRS interface - most likely opening, processing, or routing a crafted e-mail - rather than passively upon message receipt by the server daemon. The attack is network-accessible (AV:N) with low complexity (AC:L), so no special network positioning or exploit chaining is needed once credentials exist. Exploitation is concretely limited by: (1) the requirement for valid OTRS credentials at any privilege level, (2) the need for a user to actively interact with the malicious e-mail within the OTRS interface, and (3) the impact being confined to availability only with no data exfiltration path. Non-default configurations are not required - the vulnerable e-mail handling path is part of core OTRS functionality.

The CVSS 3.1 base score of 5.7 (Medium) correctly reflects a meaningful but scoped risk. The vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H decomposes as follows: the attack is network-accessible with low complexity, but two significant limiting factors depress the score - the attacker must hold low-level authenticated credentials (PR:L) and user interaction is required to trigger the vulnerable e-mail processing path (UI:R). The availability impact is High, with no confidentiality or integrity exposure. EPSS data was not provided in available intelligence, and the vulnerability is not listed in CISA KEV, so active exploitation is unconfirmed. No POC code has been identified. The UI:R flag is a notable signal: this is not a fire-and-forget network exploit; exploitation likely requires luring or coercing an authenticated user to process a malicious e-mail within the OTRS interface. For organizations where OTRS is internet-exposed with open registration or broad agent access, the realistic risk is moderate - the authentication barrier is low, but the user-interaction requirement adds meaningful friction.

An attacker with a valid OTRS agent or customer portal account crafts a specially constructed e-mail designed to trigger unbounded resource allocation when processed by the OTRS e-mail handling subsystem. After authenticating to the OTRS web interface, the attacker or a user they manipulate triggers processing of the malicious message - such as opening, importing, or routing it - causing the application to exhaust server resources until the webserver process aborts, taking the OTRS interface offline for all users. No public exploit code has been identified at time of analysis.