CVE-2026-78359: Duplicate Identity / Identity Shadowing across CustomerUser backends
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend.
This can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user.
The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify customer users.
This issue affects OTRS:
7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OTRSto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using multiple CustomerUser backends, such as both a database and LDAP backend, are exposed because email-address uniqueness is checked only within the selected backend. OTRS 7.0.X, 8.0.X, and 2023.X through 2026.X before 2026.7.X are affected; Community Edition 6.x and earlier are vulnerable, and products based on it are very likely affected.
What access does an attacker need to exploit it?
The attacker must already be authenticated and have permission to create or modify customer users. Unauthenticated users cannot use this issue to create customer accounts.
What is the practical impact of a duplicate identity?
A user can create or modify a customer user with an email address already assigned in another CustomerUser backend. Depending on workflow and backend resolution, customer-related information or email communication may be associated with or exposed to the wrong customer user.
How can administrators identify potential exposure before patching?
Review whether more than one CustomerUser backend is configured and identify email addresses that exist in multiple backends. Pay particular attention to duplicate addresses spanning database and LDAP customer-user sources, since those are not prevented by the affected uniqueness check.