What is the CVSS score of EUVD-2026-33518?

EUVD-2026-33518 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

OTRS EUVD-2026-33518

| CVE-2026-48210 MEDIUM

Information Exposure (CWE-200)

2026-05-31 OTRS

GHSA-f9pc-83mw-48hx

Information Disclosure Otrs Otrs Ag

5.7

CVSS 3.1 · Vendor: OTRS

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privileged OTRS agent
Delivery

Open ticket containing internal content
Exploit

Initiate article forwarding action
Execution

Default flag silently marks content as customer-visible
Impact

Internal data exposed on External Frontend

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated OTRS user with at least low-level privileges (PR:L per CVSS) and necessitates that the user perform a ticket article forwarding action (UI:R - passive exposure does not occur without this agent action). The vulnerable condition is specific to the forwarding workflow in OTRS 2026.3.1, where the 'Is visible for customer' visibility control is both defaulted to enabled and removed from the UI. Exploitation is limited to environments where the External Frontend (customer portal) is deployed and accessible to customers; installations that do not expose the External Frontend are not at risk of customer-visible disclosure. No network-level preconditions beyond authenticated access to the OTRS agent interface are required.
Impact	The CVSS 5.7 Medium score is driven by AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. The high confidentiality impact (C:H) reflects the potential severity of leaking internal ticket contents, but the overall score is moderated by the requirement for authenticated access (PR:L) and user interaction (UI:R - an agent must actively perform the forwarding action). This is not a remotely triggerable flaw in the traditional sense; exploitation requires a legitimate, low-privileged OTRS agent to perform a routine workflow operation. EPSS data was not provided, and this CVE is not listed in CISA KEV, nor is any POC publicly known. Real-world risk is most acute in environments where agents regularly forward tickets that contain internal-only notes or confidential diagnostics to customer-visible channels, as the misconfiguration silently promotes that content without agent awareness. Organizations with strict data-handling requirements (healthcare, legal, financial support) should treat this as higher priority than the raw score implies.
Exploit ScenarioDerived	An authenticated OTRS support agent, working a ticket that contains internal engineering notes or sensitive diagnostic data, uses the standard 'Forward' action to send the article to a third party. The 'Is visible for customer' flag is silently enforced by the misconfigured default and the toggle is hidden, so the internal content is simultaneously published to the External Frontend customer portal. The customer - or any party with access to the External Frontend - can then read ticket content that was intended to remain internal.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 31, 2026

Unintended internal ticket data exposure in OTRS 2026.3.1 occurs because the ticket article forwarding feature enforces the 'Is visible for customer' flag by default and provides no UI control to override it. Authenticated agents who forward ticket articles will inadvertently expose internal communications or notes to customers through the External Frontend without any warning or opt-out. No public exploit code exists and this is not listed in CISA KEV, but the high confidentiality impact (C:H in CVSS) makes this a meaningful data-leak risk for organizations handling sensitive support workflows.

RemediationAI

Apply the vendor-released fix per the OTRS Security Advisory 2026-09 at https://otrs.com/release-notes/otrs-security-advisory-2026-09/. No exact patched version number was provided in available data, so confirm the target upgrade version directly from the advisory before deploying. As a compensating control pending patching, administrators should instruct agents to avoid using the ticket article forwarding feature for articles that contain internal-only content, and should audit existing forwarded articles in the External Frontend for inadvertent disclosures. Additionally, review OTRS system configuration for any settings that govern visibility defaults on article actions and assess whether a configuration-level override is available in the admin panel. Note that restricting access to the forwarding feature entirely would prevent information leakage but would also disrupt legitimate forwarding workflows.

Affected VersionsENISA

OTRS 2026.3.1

Affected Packages

euvd otrs no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OTRS (Open Ticket Request System) is an enterprise service management platform used for customer support and internal IT operations. The affected component is the ticket article forwarding workflow, which relies on a visibility flag ('Is visible for customer') to control whether ticket content is surfaced to the customer-facing External Frontend portal. According to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the root cause is an improper default configuration - the flag defaults to enabled during forwarding and the UI suppresses the toggle control, removing the agent's ability to override it. This means any internal notes, inter-agent communications, or sensitive ticket metadata attached during forwarding are automatically marked as customer-visible. The affected CPE is cpe:2.3:a:otrs_ag:otrs:*:*:*:*:*:*:*:* scoped to version 2026.3.1.

Know when Otrs gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OTRS) PRIMARY 5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from Vendor (OTRS) · only source for this CVE.

CVSS VectorVendor: OTRS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend

This issue affects OTRS 2026.3.1

Threat Intelligence Overview

EPSS Score

0.0%

Top 99% exploitable

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.