Is CVE-2026-48210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48210 being exploited in the wild.

How severe is CVE-2026-48210?

Medium severity, with a CVSS score of 5.7, published 31 May 2026.

Is there a fix for CVE-2026-48210?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48210 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48210?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48210: OTRS improper default configuration in ticket article forwarding

CVE-2026-48210 · Severity: medium · CVSS 5.7 · Published 2026-05-31

OTRS, a popular service management and ticketing platform, contains a configuration error that may expose private internal communications to external customers. When staff members forward ticket articles, the system incorrectly forces these messages to be visible on the customer-facing portal without allowing staff to hide them. This could lead to the accidental disclosure of sensitive internal notes, private business logic, or confidential employee discussions to unauthorized external parties.

Quick answers

Is CVE-2026-48210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48210 being exploited in the wild.
How severe is CVE-2026-48210?: Medium severity, with a CVSS score of 5.7, published 31 May 2026.
Which products and versions are affected?: OTRS AG OTRS 2026.3.1.
Is there a fix for CVE-2026-48210?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48210 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48210?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A configuration flaw in OTRS version 2026.3.1 leads to improper privilege management and information exposure (CWE-269, CWE-200). The vulnerability is rooted in the ticket article forwarding component, where the 'Is visible for customer' flag is enforced by default and cannot be toggled off by the user through the standard interface. An authenticated internal user (agent) performing routine forwarding actions would inadvertently publish internal data to the External Frontend. This allows any customer with access to the ticket to view internal-only communications. The issue is categorized as medium severity with a CVSS score of 5.7, primarily impacting confidentiality.

Affected products

OTRS AG OTRS 2026.3.1

Timeline

2026-05-31: disclosed
2026-05-31: advisory

References

https://otrs.com/release-notes/otrs-security-advisory-2026-09/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.