# CVE-2026-78358: OTRS cross-site request forgery in administrative actions

Source: https://junglewise.ai/threats/cve-2026-78358-several-administrative-actions-do-not-sufficiently-validate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-78358 · Severity: medium · CVSS 4.3 · Published 2026-10-12

OTRS is a ticketing and issue tracking system used by organizations to manage customer requests. Attackers can trick authenticated OTRS administrators into performing unintended actions—such as deleting log entries or synchronizing configurations—by luring them to a malicious website, with no additional confirmation required. While the direct damage is limited, this could impair an organization's ability to audit and troubleshoot system issues.

Technologies: [Otrs Community Edition](https://junglewise.ai/threats/technologies/otrs-community-edition-1), [Otrs](https://junglewise.ai/threats/technologies/otrs). Vendors: [Otrs](https://junglewise.ai/threats/vendors/otrs).

## Quick answers

**Is CVE-2026-78358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78358 being exploited in the wild.

**How severe is CVE-2026-78358?** Medium severity, with a CVSS score of 4.3, published 12 October 2026.

**Which products and versions are affected?** Otrs Community Edition 6.x and before; Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, and 6.x Community Edition.

**Is there a fix for CVE-2026-78358?** Yes: fixed in 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78358 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78358?** Check whether you run Otrs Community Edition or Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.7.x and later

## Technical details

Multiple administrative endpoints in OTRS lack CSRF token (ChallengeToken) validation, allowing cross-site request forgery attacks. The DBUpdateLogCleanUp action is triggerable via GET requests by unauthenticated attackers targeting authenticated administrators; other endpoints can deploy or synchronize configurations without proper request origin validation. Export and read-only endpoints also lack tokens but are protected by browser same-origin policy, limiting exposure.

## Affected products

- OTRS OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, and 6.x Community Edition
- OTRS Community Edition 6.x and before

## Timeline

- 2026-10-12: disclosed

## Related threats

- [OTRS Community Edition HTTP authentication header spoofing](https://junglewise.ai/threats/cve-2026-93582-the-http-basic-authentication-modules-in-otrs-community-edition-6)
- [OTRS CSV injection via formula characters in user-controlled values](https://junglewise.ai/threats/cve-2026-93581-user-controlled-values-are-not-sufficiently-neutralized-when)
- [OTRS insufficient customer user identity uniqueness enforcement](https://junglewise.ai/threats/cve-2026-78359-otrs-does-not-sufficiently-enforce-the-uniqueness-of-customer)
- [OTRS authentication token invalidation delay on account deactivation](https://junglewise.ai/threats/cve-2026-78357-previously-issued-authentication-tokens-are-not-immediately)
- [OTRS Agent Frontend authentication bypass in configuration endpoint](https://junglewise.ai/threats/cve-2026-78356-the-otrs-agent-frontend-configuration-endpoint-can-be-accessed)