CVE-2026-48191: Otrs

Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days.

An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This issue affects OTRS with STORM modules: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X

Affected products

• Otrs Otrs: from 7.0.0, up to and including 8.0.37; from 2023.0.0, before 2026.4.1 (fixed in 2026.4.1)

Published 2026-06-01. Last modified 2026-07-22.