{"id":"CVE-2026-48211","title":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack","summary":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's Challeng…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cwe":["CWE-352"],"vendor":"OTRS GmbH (former OTRS AG)","product":"OTRS","affected":["OTRS 7.0.x","OTRS 8.0.x","OTRS 2023.x","OTRS 2024.x","OTRS 2025.x","OTRS >= 2026.x <= 2026.6.x","otrs_community_edition 6.x"],"published":"2026-10-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T20:38:44.050","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48211","references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-10/","label":"security@otrs.com"}],"tags":["nvd","cve.org"],"epss":0.00117,"epssPercentile":0.01671,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T17:51:33.263054Z"},"ingestedAt":"2026-10-12T14:50:34.094Z","slug":"CVE-2026-48211","body":"## Overview\n\nAn authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}