CVE-2026-78356: Unauthenticated Disclosure of Agent Frontend Configuration
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details.
The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks.
This issue affects OTRS:
8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user who can reach the OTRS Agent Frontend configuration endpoint can retrieve the exposed configuration. No valid account or user interaction is required.
What information can be exposed?
The endpoint may disclose frontend routes and associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. The disclosed configuration does not directly contain user credentials.
Does this vulnerability allow an attacker to change OTRS configuration?
No. The issue is limited to unauthorized disclosure of Agent Frontend configuration and does not provide unauthorized modification of OTRS configuration.
Which OTRS releases are affected?
Affected releases are OTRS 8.0.X and 2023.X through 2026.X before 2026.7.X.
How could the disclosed data be used by an attacker?
An attacker could use the configuration to fingerprint the OTRS installation and identify enabled functionality or security-relevant settings when preparing further attacks.