{"id":"CVE-2026-48191","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-48191","generatedAt":"2026-10-28T03:40:57.628Z","title":"An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them.","description":"An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them.\n\nThis issue affects OTRS with STORM modules: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.4.X","published":"2026-06-01T04:16:23.000Z","lastModified":"2026-07-22T07:10:00.000Z","status":"Analyzed","sourceIdentifier":"security@otrs.com","cvss":{"version":"3.1","score":3.5,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"},"cwe":["CWE-276"],"affected":["otrs/otrs"],"epss":{"score":0.00143,"percentile":0.03589,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-05/","tags":["Vendor Advisory"],"source":"security@otrs.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-48191","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}