OTRS CVE-2026-78356

Exploitation requires network reachability to the OTRS Agent Frontend's configuration endpoint, which per the advisory is accessible without authentication across affected versions (8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X). No credentials, user interaction, or non-default configuration are needed - the endpoint is exposed by default. The principal limiting factors are network exposure (impact is far higher for internet-facing instances than for those behind a VPN or internal-only segmentation) and the inherently read-only, low-sensitivity nature of the leaked data: it exposes configuration metadata (routes, authorization groups, auth config, enabled features, third-party integration settings) but explicitly no user credentials and no ability to modify OTRS configuration, bounding the direct impact to reconnaissance.

This is a genuine but moderate-priority issue, not a critical one. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 MEDIUM) consistently describes a network-reachable, low-complexity, unauthenticated information disclosure with only low confidentiality impact and no integrity or availability impact - fully aligned with the description and CWE-497 (exposure of sensitive system information). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation: exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict - they uniformly point to a low-severity reconnaissance-enabling flaw rather than a directly damaging one. The real-world value to an attacker is preparatory: the leaked configuration (frontend routes and their authorization groups, authentication configuration, enabled features, third-party integration settings) aids fingerprinting and target selection but does not itself grant access, credentials, or modification. Priority is appropriate as a 'patch in normal cycle' item, elevated only where the OTRS instance is internet-facing. Note the absence of EPSS/KEV/POC is a lack of data, not evidence of safety.

An unauthenticated attacker on the network sends a direct HTTP request to the OTRS Agent Frontend configuration endpoint and receives internal application configuration intended only for authenticated agents. The attacker uses the disclosed routes, authorization groups, enabled features, and integration settings to fingerprint the installation and map security-relevant functionality before attempting a more targeted follow-on attack. No public exploit was identified at time of analysis, though the request requires no authentication, user interaction, or special tooling.