OTRS CVE-2026-48191

Exploitation requires an active authenticated session with at least low-level privileges within OTRS (PR:L per CVSS vector) and user interaction to trigger the Document Search Article Meta Filters feature (UI:R per CVSS vector). Critically, the deployment must have STORM modules installed and the Document Search Article Meta Filters capability enabled - standalone OTRS 2026.x with the Document Search feature is also in scope per the vendor description. The vulnerability is limited to leaking aggregate metadata counts (number of CIs, SLAs, services) for restricted objects; actual content, details, or records of those objects are not exposed. Exploitation is further constrained by the requirement for an insider or authenticated attacker - external unauthenticated attackers cannot exploit this vulnerability.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N yields a Low severity score of 3.5, and the real-world risk profile aligns with this rating. Exploitation requires a valid authenticated session (PR:L) and some form of user interaction (UI:R), meaning drive-by or unauthenticated mass exploitation is not possible. The impact is strictly limited to confidentiality of metadata counts (C:L), with no integrity or availability impact. No EPSS data was provided in the source intelligence, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. The 'Privilege Escalation' tag in the source data is somewhat misleading - the actual impact is information disclosure of aggregate counts rather than elevation of privilege to access restricted objects. For organizations running OTRS with STORM in multi-tenant or segmented environments (e.g., managed service providers), leaking CI/SLA/service counts could assist insider threat reconnaissance, making impact context-dependent rather than universally negligible.

An authenticated OTRS user with a standard low-privileged agent account accesses the Document Search interface and applies Article Meta Filters scoped to CI groups, SLA tiers, or service categories they are not authorized to view. The filter query returns metadata counts (e.g., the number of matching CIs or active SLAs), allowing the user to infer the structure and scale of ITSM objects they have no formal access to, supporting internal reconnaissance of the service management environment.