CVE-2026-48209

HIGH 7.1

Reflected XSS in authenticated agent context

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

11th

An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket actions. By injecting malicious JavaScript into manipulated request URLs, attackers can execute arbitrary script code in the context of an authenticated agent session when the crafted link is opened. This issue affects OTRS: * 7.0.x Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

CWE	CWE-79 CWE-116
Vendor	otrs ag
Product	otrs
Published	Jun 1, 2026
Last Updated	Jun 1, 2026

Stay Ahead of the Next One

Get instant alerts for otrs ag otrs

Be the first to know when new high vulnerabilities affecting otrs ag otrs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

OTRS AG / OTRS

7.0.x

OTRS AG / ((OTRS)) Community Edition

6.x

References

NVD ↗ CVE.org ↗ EPSS Data ↗

otrs.com: https://otrs.com/release-notes/otrs-security-advisory-2026-08/

Credits

Special thanks to William Bastos (@chor4o) for reporting this vulnerability