OTRS CVE-2026-48189

Two explicit non-default conditions must both be true for exploitation to be possible: (1) the Customer Backend feature must be actively enabled in the OTRS installation, and (2) CustomerGroupSupport must be configured and in use - without CustomerGroupSupport, there are no group-based restrictions to bypass, making the vulnerability moot. Beyond these configuration gates, the CVSS vector confirms the attacker must hold a valid low-privilege account (PR:L) - unauthenticated exploitation is not possible. The UI:R component further indicates the attack is not fully automated; some interactive step by the attacker (such as navigating the interface or triggering a specific lookup action) is required. What limits exploitation: non-default configuration (CustomerGroupSupport disabled by default narrows exposed population), mandatory authentication, and the non-automated nature of the attack. The vulnerability does not affect integrity or availability - impact is confined to unauthorized read of restricted customer data.

The CVSS 3.1 base score of 5.7 (Medium) reflects a balanced risk profile: network-reachable (AV:N), low complexity (AC:L), but requiring low-privilege authentication (PR:L) and user interaction (UI:R), with scope unchanged and impact confined entirely to confidentiality (C:H/I:N/A:N). The high confidentiality impact score is notable - once exploited, the attacker gains full read access to otherwise-restricted customer records, not merely partial data. However, two significant real-world limiting factors reduce urgency: first, exploitation is only possible when the CustomerGroupSupport feature is explicitly enabled, which is a non-default configuration; second, the UI:R component indicates the attack is not fully automated and requires interactive steps. No EPSS score was provided in the source data, no POC is publicly known, and this CVE is not in the CISA KEV catalog. The net real-world priority is moderate for organizations using CustomerGroupSupport, and low-to-negligible for those not using that feature.

An authenticated OTRS agent with a low-privilege account - one restricted to a specific customer group - submits a crafted request to the Customer Backend module referencing customer identifiers or query parameters that belong to a different, restricted group. The missing input validation allows the backend to return the restricted customer records in response, exposing names, contact details, ticket history, or other sensitive data that the agent's group membership should have blocked. No public exploit code is known, but the attack complexity is low once an attacker understands the module's query parameters.