What is the CVSS score of EUVD-2026-33518?

EUVD-2026-33518 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

OTRS EUVD-2026-33518

| CVE-2026-48210 MEDIUM

Information Exposure (CWE-200)

2026-05-31 OTRS

GHSA-f9pc-83mw-48hx

Information Disclosure Otrs

5.7

CVSS 3.1 · Vendor: OTRS

Severity by source

Vendor (OTRS) PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from Vendor (OTRS) · only source for this CVE.

CVSS VectorVendor: OTRS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 31, 2026 - 21:50 vuln.today

DescriptionCVE.org

An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend

This issue affects OTRS 2026.3.1

AnalysisAI

Unintended internal ticket data exposure in OTRS 2026.3.1 occurs because the ticket article forwarding feature enforces the 'Is visible for customer' flag by default and provides no UI control to override it. Authenticated agents who forward ticket articles will inadvertently expose internal communications or notes to customers through the External Frontend without any warning or opt-out. No public exploit code exists and this is not listed in CISA KEV, but the high confidentiality impact (C:H in CVSS) makes this a meaningful data-leak risk for organizations handling sensitive support workflows.

Technical ContextAI

OTRS (Open Ticket Request System) is an enterprise service management platform used for customer support and internal IT operations. The affected component is the ticket article forwarding workflow, which relies on a visibility flag ('Is visible for customer') to control whether ticket content is surfaced to the customer-facing External Frontend portal. According to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the root cause is an improper default configuration - the flag defaults to enabled during forwarding and the UI suppresses the toggle control, removing the agent's ability to override it. This means any internal notes, inter-agent communications, or sensitive ticket metadata attached during forwarding are automatically marked as customer-visible. The affected CPE is cpe:2.3:a:otrs_ag:otrs:*:*:*:*:*:*:*:* scoped to version 2026.3.1.

RemediationAI

Apply the vendor-released fix per the OTRS Security Advisory 2026-09 at https://otrs.com/release-notes/otrs-security-advisory-2026-09/. No exact patched version number was provided in available data, so confirm the target upgrade version directly from the advisory before deploying. As a compensating control pending patching, administrators should instruct agents to avoid using the ticket article forwarding feature for articles that contain internal-only content, and should audit existing forwarded articles in the External Frontend for inadvertent disclosures. Additionally, review OTRS system configuration for any settings that govern visibility defaults on article actions and assess whether a configuration-level override is available in the admin panel. Note that restricting access to the forwarding feature entirely would prevent information leakage but would also disrupt legitimate forwarding workflows.