CVE-2026-78358 OTRS GmbH (former OTRS AG) CVE debrief

Who should care

Administrators and security teams responsible for OTRS installations should assess exposure and prioritize verification of ChallengeToken validation for administrative actions. This includes reviewing the current configuration, ensuring proper logging and backup of DBUpdate log entries, and coordinating with relevant stakeholders to address potential disruptions.

Why it matters

A CSRF vulnerability in OTRS administrative actions allows unauthenticated remote attackers to delete DBUpdate log entries and potentially disrupt administrative actions. Administrators and security teams should prioritize verifying ChallengeToken validation and ensuring log entries are properly backed up.

• Potential deletion of DBUpdate log entries, reducing diagnostic and historical information.
• Possible disruption of administrative actions, impacting system availability.
• Need for verification of ChallengeToken validation for administrative actions.
• Potential for other actions to be triggered through forged requests.

Technical summary

The DBUpdateLogCleanUp action in OTRS can be triggered via a GET request without validating a ChallengeToken, allowing an unauthenticated remote attacker to execute the cleanup action. Additional administrative endpoints were identified that do not validate a ChallengeToken, potentially allowing for other actions to be triggered. Successful exploitation can delete existing DBUpdate log entries, potentially reducing the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed.

Defensive priority

Administrators and security teams should prioritize verifying the ChallengeToken validation for administrative actions and ensuring that log entries are properly backed up.

Recommended defensive actions

• Verify ChallengeToken validation for administrative actions
• Ensure log entries are properly backed up
• Review and update affected versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the CSRF vulnerability in OTRS administrative actions. The vendor's security advisory provides additional context on the affected versions and recommended actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.