OTRS GmbH up to 2026.X CSRF Protection DBUpdateLogCleanUp cross-site request forgery

Summaryinfo

A vulnerability described as problematic has been identified in OTRS GmbH OTRS up to 2026.X. This vulnerability affects the function DBUpdateLogCleanUp of the component CSRF protection. Executing a manipulation can lead to cross-site request forgery. This vulnerability appears as CVE-2026-78358. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in OTRS GmbH OTRS up to 2026.X and classified as problematic. This vulnerability affects the function DBUpdateLogCleanUp of the component CSRF Protection. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed. Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself.  Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site request, the response content remains subject to the browser's same-origin restrictions and is not automatically exposed to the attacker. Therefore, no direct confidentiality impact has been demonstrated for these endpoints. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

The advisory is shared for download at otrs.com. This vulnerability was named CVE-2026-78358 since 08/24/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3872). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• OTRS OTRS

Productinfo

Type

• Service Management Software

Vendor

• OTRS GmbH

Name

• OTRS

Version

• 7.0.X
• 8.0.X
• 2023.X
• 2024.X
• 2025.X
• 2026.X

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion