{"id":"CVE-2026-48190","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-48190","generatedAt":"2026-10-28T00:19:11.680Z","title":"An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information.","description":"An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affected.\n\nThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.4.X","published":"2026-06-01T04:16:23.000Z","lastModified":"2026-07-22T07:10:00.000Z","status":"Analyzed","sourceIdentifier":"security@otrs.com","cvss":{"version":"3.1","score":3.5,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"},"cwe":["CWE-276"],"affected":["otrs/otrs"],"epss":{"score":0.00143,"percentile":0.03586,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-04/","tags":["Vendor Advisory"],"source":"security@otrs.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-48190","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}