CVE-2026-48211: Cross-Site Request Forgery in Import/Export Admin console
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.
This issue affects OTRS:
7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations running affected OTRS versions are exposed when an administrator has an active authenticated session and can be induced to submit a malicious request. OTRS 7.0.X, 8.0.X, and 2023.X through 2026.X before 2026.7.X are affected; Community Edition 6.x and earlier are vulnerable, and products based on Community Edition are very likely affected.
What does an attacker need to exploit it?
The attacker does not need to authenticate to OTRS, but must cause an authenticated administrator to make a crafted request. Exploitation relies on the administrator having an active session with permission to delete Import/Export templates.
What is the impact of successful exploitation?
A successful CSRF request can delete administrative Import/Export templates. The provided severity vector indicates integrity and availability impact, with no confidentiality impact.
How can I tell whether my deployment is vulnerable?
Check the OTRS version and whether the affected AdminImportExport::TemplateDelete action is present without ChallengeToken validation. Versions in the listed affected ranges should be treated as vulnerable; Community Edition 6.x and earlier should also be treated as vulnerable.
What should be prioritized if immediate remediation is not possible?
Limit exposure of authenticated administrators to untrusted content while their OTRS sessions are active, since exploitation requires inducing an active administrator to submit a malicious request. Prioritize protecting accounts that can delete Import/Export templates.