OTRS CVE-2026-78358

Exploitation requires an OTRS administrator to be authenticated with an active session AND to be lured into loading an attacker-controlled web page (UI:R); the forged GET request to the DBUpdateLogCleanUp action succeeds because that action does not validate a ChallengeToken (anti-CSRF token). Limiting factors: the attacker cannot choose or verify success remotely, cannot read any response (same-origin policy blocks the export/read-only endpoints), and cannot introduce new configuration via the forged request. Impact is bounded to DBUpdate log entries present at the moment the request is processed. Affected: OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X, plus ((OTRS)) Community Edition 6.x and earlier and derivative products.

This is a genuine but low-severity CSRF issue (CWE-352), and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3 MEDIUM) correctly reflects a network-reachable flaw that nonetheless depends on user interaction: the attacker is unauthenticated (PR:N) but must trick an already-authenticated administrator into loading a malicious page (UI:R). Impact is narrow - the confirmed primary action (DBUpdateLogCleanUp) only deletes existing DBUpdate log entries, hence C:N and a single low impact metric. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or opportunistic exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' Critically, the vendor itself notes the additional unprotected endpoints do NOT let an attacker inject new configuration, and the read-only/export endpoints are shielded by same-origin policy, so no confidentiality impact was demonstrated. Net: a real, vendor-confirmed hygiene defect worth patching in routine cycles, not an emergency - the low technical impact (log deletion) plus mandatory admin interaction make widespread or high-consequence exploitation unlikely.

An attacker crafts a web page containing an auto-loading GET request (e.g., an image/iframe src) targeting the OTRS DBUpdateLogCleanUp action, then lures a logged-in OTRS administrator to visit it. Because the action does not validate a ChallengeToken, the admin's authenticated browser silently executes the cleanup, deleting existing DBUpdate log entries. No public exploit code is identified at time of analysis, and success requires the admin to have an active authenticated session when visiting the malicious page.