OTRS CVE-2026-48211

Exploitation requires that an OTRS administrator holds an active authenticated session AND is induced via social engineering (UI:R) to trigger an attacker-crafted request to the AdminImportExport::TemplateDelete action, which fails to validate the anti-CSRF ChallengeToken. The deployment must actually use the Import/Export template feature for the deletion to have meaningful impact. Limiting factors: the attacker gains no direct access or privileges, cannot act without a concurrently logged-in admin, the impact is confined to deletion of Import/Export templates (no code execution, no data disclosure), and the window is bounded by the duration of a live admin session. Affected: OTRS 7.0.X, 8.0.X, 2023.X-2026.X before 2026.7.X, and ((OTRS)) Community Edition 6.x and earlier.

This is a moderate-severity CSRF vulnerability (CWE-352) whose real-world risk is tempered by its required preconditions. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, 5.4 Medium) correctly models CSRF: the attacker is unauthenticated (PR:N) and acts remotely over the network (AV:N), but success hinges on user interaction (UI:R) - specifically tricking a logged-in administrator into triggering the crafted request. There is no confidentiality impact (C:N) and only limited integrity/availability impact (I:L/A:L), since the only demonstrated effect is deletion of Import/Export templates rather than full system compromise. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied, so exploitation-probability and automatability signals are entirely absent. No public exploit identified at time of analysis. Signals are internally consistent (no CVSS-vs-description conflict), but note the apparent tension that the description says an 'authenticated administrator' is the victim while the vector shows PR:N - this is expected for CSRF, where the attacker needs no privileges because the victim's authenticated session supplies them; it is not a data error. Overall this is a legitimate but lower-priority issue: real risk exists only where administrators actively use the Import/Export feature and can be socially engineered, making it targeted rather than mass-exploitable.

An attacker crafts a malicious web page or email containing a hidden request to the OTRS AdminImportExport::TemplateDelete action and lures an administrator who holds an active OTRS session into opening it. Because the action does not validate the ChallengeToken, the victim's browser silently submits the forged request and the administrative Import/Export template is deleted under the admin's privileges. No public exploit code is referenced, but the attack requires only basic HTML and successful social engineering of an authenticated admin.