Description

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed. Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself.  Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site request, the response content remains subject to the browser's same-origin restrictions and is not automatically exposed to the attacker. Therefore, no direct confidentiality impact has been demonstrated for these endpoints. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T07:16:37.277Z",
  "pubdate": "2026-10-12T07:16:37.277Z",
  "executiveSummary": "Multiple administrative endpoints within OTRS are susceptible to Cross-Site Request Forgery (CSRF) vulnerabilities due to insufficient validation of request origin, specifically the lack of a ChallengeToken.\nThe vulnerability allows an unauthenticated remote attacker to force an authenticated administrator's browser to execute unauthorized administrative actions.\nAffected products include OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X, as well as ((OTRS)) Community Edition 6.x and earlier.\nImpact varies by endpoint; specifically, the DBUpdateLogCleanUp action allows for the deletion of diagnostic and historical audit logs. Other identified endpoints permit the unauthorized execution of configuration deployment or synchronization tasks.\nWhile certain read-only or export endpoints are also affected, these are mitigated by browser same-origin policies preventing direct data exfiltration, though the primary risk remains unauthorized state-changing operations performed by authenticated victims.\nSuccessful exploitation requires the victim administrator to be authenticated in an active session while interacting with malicious content controlled by the attacker.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the OTRS application to implement or enforce ChallengeToken validation across critical administrative endpoints, including the DBUpdateLogCleanUp function.\nThe application relies on state-changing requests—some of which are processed via GET methods—without verifying that the request was intentionally initiated by the authorized administrator.\nAn attacker can exploit this by embedding a crafted, malicious request within a third-party webpage or via a spear-phishing link. When an authenticated administrator visits the malicious content while their OTRS session is active, the browser automatically attaches the session-specific authentication cookies to the forged request.\nBecause the server-side logic does not validate a unique, per-session, or per-request ChallengeToken, the server treats the forged request as a legitimate administrative command.\nIn the case of the DBUpdateLogCleanUp action, the impact is the unauthorized deletion of DBUpdate log entries, which results in a loss of audit integrity and diagnostic data. Other endpoints, such as those governing configuration deployment or synchronization, allow an attacker to influence the state of the application by forcing existing configuration routines to run unexpectedly, although this does not permit the injection of arbitrary new configurations.\nThe attack is characterized as a blind CSRF for state-changing endpoints. For read-only or data export endpoints, the browser's Same-Origin Policy (SOP) typically prevents the attacker from reading the response body of the forged request, which restricts the confidentiality impact compared to the integrity impact observed in administrative actions.\nThe vulnerability affects a broad range of OTRS versions: 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X prior to 2026.7.X. Legacy versions, including ((OTRS)) Community Edition 6.x and all predecessors, are also confirmed as vulnerable. The attack requires no prior authentication from the attacker's perspective, as the burden of authentication is offloaded to the victim's existing session.\nThe persistence of this issue across multiple endpoints suggests a systematic lack of CSRF protection mechanisms in the application's administrative framework."
}