CVE-2026-78358: Cross-Site Request Forgery in Administrative Actions
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed.
Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself.
Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site request, the response content remains subject to the browser's same-origin restrictions and is not automatically exposed to the attacker. Therefore, no direct confidentiality impact has been demonstrated for these endpoints.
This issue affects OTRS:
7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations are exposed when an authenticated OTRS administrator visits a malicious web page while their browser can send requests to the OTRS instance. The attacker does not need to authenticate to OTRS, but relies on the administrator's active authenticated session.
What can an attacker do through the vulnerable request?
An attacker can cause DBUpdate log cleanup, deleting DBUpdate log entries that exist when the forged request is processed. Other affected administrative endpoints may deploy or synchronize existing configuration, but the CSRF request cannot introduce arbitrary new configuration.
Does exploitation require user interaction?
Yes. An authenticated administrator must be induced to load a malicious page containing a crafted request. The DBUpdateLogCleanUp action is especially exposed because it can be invoked through a GET request without ChallengeToken validation.
How can I determine whether an action is affected?
Affected endpoints are characterized by missing ChallengeToken validation. The described DBUpdateLogCleanUp action can be triggered by GET without validating a ChallengeToken; additional administrative, export, and read-only endpoints were also identified as lacking this validation.