What is the CVSS score of CVE-2026-48189?

CVE-2026-48189 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

OTRS CVE-2026-48189

EUVD-2026-33551 MEDIUM

Information Exposure (CWE-200)

2026-06-01 OTRS

GHSA-9prp-8cr9-jvwq

Information Disclosure Otrs

5.7

CVSS 3.1 · Vendor: OTRS

Severity by source

Vendor (OTRS) PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from Vendor (OTRS) · only source for this CVE.

CVSS VectorVendor: OTRS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 04:22 vuln.today

DescriptionCVE.org

An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature has to be anabled and CustomerGroupSupport has to be used to be affected.

This issue affects OTRS:

7.0.X
8.0.X
2023.X
2024.X
2025.X
2026.X before 2026.4.X

AnalysisAI

Improper input validation in the OTRS Customer Backend module allows authenticated low-privilege users to bypass group-based access controls and read customer records restricted to other groups. Affected versions span every major OTRS release line (7.0.X through 2026.X before 2026.4.X), though exploitation is gated by a non-default configuration requirement. No public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

OTRS (Open Ticket Request System) is an enterprise service management platform by OTRS AG, identified under CPE cpe:2.3:a:otrs_ag:otrs:*:*:*:*:*:*:*:*. The affected component is the Customer Backend module, which handles customer data lookups and presentation within the OTRS agent interface. When the CustomerGroupSupport feature is enabled, OTRS enforces group-based segmentation of customer records, restricting which agents or customer users can view which customer data sets. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the module fails to validate input in a way that enforces these group boundaries, permitting a request to retrieve customer data outside the caller's authorized group scope. This is a logic-level input validation failure rather than a memory corruption or injection class vulnerability.

RemediationAI

The vendor-released patch is OTRS 2026.4.X, confirmed by the OTRS Security Advisory 2026-03 at https://otrs.com/release-notes/otrs-security-advisory-2026-03/. Organizations should upgrade to OTRS 2026.4.X or later as the primary remediation. For organizations unable to patch immediately, a direct compensating control is to disable the CustomerGroupSupport feature; this eliminates the vulnerable code path entirely but also removes group-based customer segmentation, which may be a business-critical capability. A secondary compensating control is to restrict access to the OTRS agent interface to trusted internal network segments via firewall or reverse proxy ACLs, reducing the network-reachable attack surface (AV:N) to a more limited exposure. Administrators should review which agent accounts hold low-privilege access and audit their group memberships as a temporary detective measure while patching is planned.