OTRS EUVD-2026-33550

Exploitation requires all three of the following conditions to be simultaneously true: (1) the attacker holds a valid customer account with access to the OTRS External Interface - confirmed by CVSS PR:L (low-privilege authenticated user); (2) the CMDB module is explicitly enabled in the OTRS instance, which is not the default state; and (3) CustomerGroupSupport is actively configured, also a non-default setting. The absence of either condition two or three fully prevents exploitation. The CVSS UI:R component indicates the attacker must actively navigate to the ConfigItem List and interact with it - passive or automated triggering is not applicable. Exploitation is strictly read-only: no data modification or service disruption is possible (I:N, A:N). Organizations running OTRS without CMDB or without CustomerGroupSupport are unaffected regardless of version.

Overall risk is low. CVSS 3.5 reflects a network-reachable (AV:N), low-complexity (AC:L) issue requiring a low-privilege authenticated session (PR:L) and some user interaction (UI:R), with only partial confidentiality impact (C:L) and zero integrity or availability impact. No EPSS score was included in source data. The absence from CISA KEV and the lack of any reported public exploit code further reduce urgency. Exploitation is structurally gated behind two non-default configuration conditions - CMDB enabled and CustomerGroupSupport active - meaning the vast majority of OTRS deployments that do not use both are not affected. The UI:R signal suggests automated, opportunistic exploitation is not straightforward. The primary realistic risk is insider-adjacent: a legitimately credentialed customer account enumerating asset or infrastructure records beyond their authorized group, potentially exposing sensitive CMDB inventory to unintended parties.

An authenticated customer logs into the OTRS External Interface portal on an instance where both CMDB and CustomerGroupSupport are active. By navigating to the ConfigItem List module and submitting CI queries, the customer retrieves configuration item records belonging to groups outside their assigned scope - potentially exposing asset names, IP addresses, service dependencies, or other infrastructure details stored in the CMDB. No public exploit code has been identified; exploitation requires a valid customer credential and manual interaction with the portal.