What is the CVSS score of CVE-2026-48190?

CVE-2026-48190 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

OTRS CVE-2026-48190

EUVD-2026-33550 LOW

Incorrect Default Permissions (CWE-276)

2026-06-01 OTRS

GHSA-8vpg-x36g-r8gw

Privilege Escalation Otrs

3.5

CVSS 3.1 · Vendor: OTRS

Severity by source

Vendor (OTRS) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Primary rating from Vendor (OTRS) · only source for this CVE.

CVSS VectorVendor: OTRS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 04:23 vuln.today

DescriptionCVE.org

An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affected.

This issue affects OTRS:

7.0.X
8.0.X
2023.X
2024.X
2025.X
2026.X before 2026.4.X

AnalysisAI

Incorrect permission enforcement in OTRS External Interface and ConfigItem List module allows an authenticated customer to query Configuration Item (CI) data beyond their authorized group scope. The flaw is conditional - both the CMDB module and CustomerGroupSupport must be active simultaneously, substantially narrowing the affected population. Rated CVSS 3.5 (Low) with no confirmed active exploitation and no public exploit code identified at time of analysis, this is a scoped information disclosure risk primarily threatening organizations that expose CMDB asset data through the customer portal.

Technical ContextAI

OTRS (Open Ticket Request System) is an enterprise IT service management and helpdesk platform developed by OTRS AG. The External Interface is the customer-facing web portal, and the ConfigItem List is a component of the optional CMDB (Configuration Management Database) module used to track IT assets, services, and infrastructure as configuration items. The affected CPE is cpe:2.3:a:otrs_ag:otrs:*:*:*:*:*:*:*:*. The root cause is CWE-276 (Incorrect Default Permissions), meaning access control checks governing which CI records a customer may query are improperly applied when CustomerGroupSupport is enabled - a feature intended to scope customer visibility to specific organizational groups. The flaw allows the group-level permission boundary to be bypassed through the CI list query path in the External Interface.

RemediationAI

The vendor-released patch is OTRS 2026.4.X - upgrade to this version or later as the primary remediation, per the advisory at https://otrs.com/release-notes/otrs-security-advisory-2026-04/. Note that organizations running the long-term branches (7.0.X, 8.0.X, 2023.X-2025.X) must assess whether a cross-version upgrade is operationally feasible, as no backport versions are listed. If an immediate upgrade is not viable, disabling the CustomerGroupSupport feature removes the precondition for exploitation, though this trade-off eliminates customer group segmentation functionality. Alternatively, disabling the CMDB module entirely removes the vulnerable attack surface if CI tracking is not operationally required. As an additional compensating control, restricting External Interface access to trusted internal networks or VPN reduces exposure to externally reachable customer accounts, though it does not resolve the underlying permission flaw.