{"id":"CVE-2026-48211","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-48211","generatedAt":"2026-10-28T04:16:43.654Z","title":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack.","description":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","published":"2026-10-12T07:16:36.000Z","lastModified":"2026-10-15T20:38:44.000Z","status":"Deferred","sourceIdentifier":"security@otrs.com","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"},"cwe":["CWE-352"],"affected":[],"epss":{"score":0.00117,"percentile":0.01671,"date":"2026-10-27","history":[{"date":"2026-10-12","score":0.00117,"percentile":0.01547}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.12%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-12T07:16:36.000Z","detail":{"score":"5.4","severity":"MEDIUM","publishedAt":"2026-10-12T07:16:36.453Z"},"summary":"New CVE, medium severity (CVSS 5.4)."}],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-10/","source":"security@otrs.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-48211","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}