OTRS CVE-2026-48209

Exploitation requires a victim agent to be logged into OTRS 7.0.x or ((OTRS)) Community Edition 6.x (or a downstream fork built on that code) and to click an attacker-supplied URL that targets a ticket-action endpoint with crafted parameters - the CVSS UI:R confirms user interaction is mandatory, so this is not a drive-by from outside. Although CVSS lists PR:N, the description scopes impact to an 'authenticated agent session,' meaning the *victim* must be an authenticated OTRS agent for the payload to have any effect; an attacker with no relationship to the target organization can still craft the URL but needs a delivery path that reaches an agent. Limiting factors: strict CSP, HttpOnly/SameSite session cookies, and SSO with short session lifetimes all reduce realistic impact; instances accessible only over VPN further reduce exposure to external attackers.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N indicates network reach, low complexity, and - per the vector - no privileges required, yet the description states the issue affects 'authenticated attackers' targeting agent sessions, a notable discrepancy: PR:N likely reflects that the attacker who crafts the URL needs no account because the *victim* is the authenticated party, but defenders should treat this as a phishing/social-engineering vector against logged-in agents rather than a fully anonymous exploit. There is no KEV listing, no EPSS score, and no SSVC decision provided, and there is no public exploit identified at time of analysis, so this is not an immediate-fire incident; however, the high integrity impact (I:H) is justified because XSS in an agent session can pivot to ticket tampering, credential theft, or privilege escalation through stored admin actions. Realistic prioritization: above-baseline for any internet-exposed OTRS/Community-Edition portal, lower for strictly internal deployments behind SSO with strict referrer/CSP controls.

An attacker crafts a URL pointing at a ticket-action endpoint on the target OTRS instance with malicious JavaScript injected into a reflected request parameter, then delivers the link to a help-desk agent via a new ticket, email signature, or chat message. When the authenticated agent opens the link, the script executes in their session and can exfiltrate the session cookie, modify or close tickets, escalate the agent's privileges, or stage further attacks against the OTRS backend. No public exploit identified at time of analysis, but the pattern is well-understood and trivially weaponizable once the vulnerable parameter is identified.