CVE-2026-78359 OTRS GmbH (former OTRS AG) CVE debrief

Who should care

Defenders managing OTRS deployments, especially those with multiple CustomerUser backends configured, should assess exposure and verify remediation. Prioritization is recommended for environments where customer user management is critical. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential impacts.

Why it matters

Defenders should prioritize verifying and remediating this vulnerability in OTRS deployments, especially where customer user management is critical, as it may lead to customer information exposure or incorrect association.

• Customer-related information or email communication may be associated with or exposed to the wrong customer user
• Multiple customer user records may represent the same communication identity
• Authenticated users with permission to create or modify customer users may exploit this vulnerability

Technical summary

OTRS does not enforce uniqueness of customer user identities across multiple CustomerUser backends. An authenticated user can create a customer user with an email address already assigned to a customer user in another backend. This can result in multiple customer user records representing the same communication identity. Customer-related information or email communication may be associated with or exposed to the wrong customer user. Exploitation requires permissions to create or modify customer users. This issue affects OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in OTRS deployments, especially where customer user management is critical.

Recommended defensive actions

• Verify OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X are up-to-date with 2026.7.X or later
• Review customer user configurations and backend settings
• Restrict permissions to create or modify customer users
• Monitor for suspicious customer user activity
• Perform vulnerability scanning
• Implement compensating controls
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability. Additional verification is needed to confirm affected versions and deployments. Defenders should verify OTRS versions, review customer user configurations, and restrict permissions to create or modify customer users. Monitoring for suspicious customer user activity is also recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.