# CVE-2026-48190: OTRS incorrect permissions in External Interface and ConfigItem List module

Source: https://junglewise.ai/threats/cve-2026-48190-otrs-incorrect-permissions-in-external-interface-and-configitem  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-48190 · Severity: low · CVSS 3.5 · Published 2026-06-01

OTRS is a service management and ticketing platform used for customer support and IT service management. A security flaw in the customer-facing interface allows authenticated customers to view internal configuration item (CI) information they should not have access to. This could lead to the exposure of sensitive technical details about the organization's IT infrastructure. This issue only affects systems where the Configuration Management Database (CMDB) and Customer Group Support features are enabled.

Vendors: [OTRS AG](https://junglewise.ai/threats/vendors/otrs-ag).

## Quick answers

**Is CVE-2026-48190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48190 being exploited in the wild.

**How severe is CVE-2026-48190?** Low severity, with a CVSS score of 3.5, published 1 June 2026.

**Which products and versions are affected?** OTRS AG OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.4.X.

**Is there a fix for CVE-2026-48190?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48190 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48190?** Check whether you run OTRS AG OTRS Help Desk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Incorrect Default Permissions (CWE-276) exists in the OTRS External Interface and the ConfigItem List module. The flaw allows an authenticated customer user to bypass intended access restrictions and query the system for Configuration Item (CI) information from the CMDB. For a system to be vulnerable, the CMDB must be enabled and 'CustomerGroupSupport' must be active. The attack requires network access and low-level customer authentication, though the CVSS vector suggests some level of user interaction may be involved. The issue is addressed in OTRS version 2026.4.X.

## Affected products

- OTRS AG OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.4.X

## Timeline

- 2026-06-01: disclosed: Initial publication of the CVE record
- 2026-06-01: advisory: NVD record published based on OTRS AG advisory

## References

- [https://otrs.com/release-notes/otrs-security-advisory-2026-04/](https://otrs.com/release-notes/otrs-security-advisory-2026-04/)

## Related threats

- [OTRS Customer Backend improper input validation](https://junglewise.ai/threats/cve-2026-48189-otrs-customer-backend-improper-input-validation)