Description

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-12T07:16:36.453Z",
  "pubdate": "2026-10-12T07:16:36.453Z",
  "executiveSummary": "This vulnerability is a Cross-Site Request Forgery (CSRF) flaw residing within the OTRS administrative interface, specifically concerning the management of Import/Export templates. The security weakness allows an unauthenticated remote attacker to force an authenticated administrator to execute unauthorized actions against the system without their knowledge or consent.\nBy inducing an administrator to trigger a malicious request, an attacker can delete critical administrative Import/Export templates, leading to service disruption, loss of configuration data, and administrative workflow degradation. The vulnerability stems from the failure of the 'AdminImportExport::TemplateDelete' action to validate the anti-CSRF 'ChallengeToken' mechanism.\nAffected versions include OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and versions of 2026.X prior to 2026.7.X. Legacy ((OTRS)) Community Edition 6.x and earlier releases are also confirmed vulnerable. Successful exploitation requires the victimized administrator to maintain an active session while interacting with the attacker's malicious content. Given the administrative privileges involved, this poses a significant risk to the integrity and availability of the OTRS management environment.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of request validation within the OTRS Import/Export administrative module. Specifically, the 'AdminImportExport::TemplateDelete' function performs state-changing operations—namely, the removal of configuration templates—without verifying the presence or validity of a 'ChallengeToken'. In the context of OTRS, the 'ChallengeToken' serves as the primary anti-CSRF defense mechanism intended to ensure that requests are legitimately originated from the authenticated user interface rather than external, malicious sources.\nThe attack flow begins when an unauthenticated remote attacker identifies the predictable structure of the 'TemplateDelete' HTTP request. The attacker then constructs a malicious payload, typically embedded within a crafted HTML page, an image tag, or a hidden form submitted via JavaScript on a third-party site. When an administrator with an active, authenticated OTRS session visits the attacker's controlled domain, the browser automatically includes the administrator's session cookies in the malicious request targeting the OTRS server.\nBecause the 'AdminImportExport::TemplateDelete' function fails to validate the CSRF token, the OTRS application processes the request as if it were a legitimate administrative action initiated from within the internal management console. The server validates the session cookie, confirms the user's high-level privileges, and proceeds to delete the specified Import/Export template.\nThis exploit is characterized by its reliance on the victim's ambient authority. Since the application does not verify the origin of the request or the authenticity of the token, the attacker effectively bypasses the application's intent-based security controls. The impact is primarily focused on the unauthorized deletion of administrative assets. While the exploit does not directly grant the attacker arbitrary code execution or session hijacking, it facilitates a Denial of Service (DoS) vector regarding administrative templates and configurations. This can be weaponized to disrupt organizational workflows, delete data mappings required for system interoperability, and force administrators to manually recover or restore critical configuration templates. The vulnerability persists across a wide range of OTRS versions, including the identified 7.0.X through 2026.6.X branches, and remains a risk for any derivative systems that inherit this faulty module logic."
}