{"api_version":"1","generated_at":"2026-06-01T08:44:18+00:00","cve":"CVE-2026-48189","urls":{"html":"https://cve.report/CVE-2026-48189","api":"https://cve.report/api/cve/CVE-2026-48189.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-48189","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-48189"},"summary":{"title":"Bypass DedicatedAgentToCustomerGroups Setting","description":"An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature has to be anabled and CustomerGroupSupport has to be used to be affected.\n\nThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.4.X","state":"PUBLISHED","assigner":"OTRS","published_at":"2026-06-01 04:16:22","updated_at":"2026-06-01 04:16:22"},"problem_types":["CWE-200","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":[{"version":"3.1","source":"security@otrs.com","type":"Secondary","score":"5.7","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.7","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-03/","name":"https://otrs.com/release-notes/otrs-security-advisory-2026-03/","refsource":"security@otrs.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48189","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48189","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"OTRS AG","product":"OTRS","version":"affected 7.0.x","platforms":[]},{"source":"CNA","vendor":"OTRS AG","product":"OTRS","version":"affected 8.0.x","platforms":[]},{"source":"CNA","vendor":"OTRS AG","product":"OTRS","version":"affected 2023.x","platforms":[]},{"source":"CNA","vendor":"OTRS AG","product":"OTRS","version":"affected 2024.x","platforms":[]},{"source":"CNA","vendor":"OTRS AG","product":"OTRS","version":"affected 2025.x","platforms":[]},{"source":"CNA","vendor":"OTRS AG","product":"OTRS","version":"affected 2026.x 2026.3.x patch","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Update to OTRS 2026.4.1. or later. Please note that there will be no OTRS 7 patches","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"affected","modules":["Customer Backend"],"product":"OTRS","vendor":"OTRS AG","versions":[{"status":"affected","version":"7.0.x"},{"status":"affected","version":"8.0.x"},{"status":"affected","version":"2023.x"},{"status":"affected","version":"2024.x"},{"status":"affected","version":"2025.x"},{"lessThanOrEqual":"2026.3.x","status":"affected","version":"2026.x","versionType":"patch"}]}],"datePublic":"2026-06-01T07:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature has to be anabled and&nbsp;<code>CustomerGroupSupport</code>&nbsp;has to be used to be affected.<p></p><p>This issue affects OTRS: </p><ul><li>7.0.X</li><li>8.0.X</li><li>2023.X</li><li>2024.X</li><li>2025.X</li><li>2026.X before 2026.4.X</li></ul><br><p></p>"}],"value":"An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature has to be anabled and CustomerGroupSupport has to be used to be affected.\n\nThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.4.X"}],"impacts":[{"capecId":"CAPEC-54","descriptions":[{"lang":"en","value":"CAPEC-54 Query System for Information"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-06-01T03:33:03.373Z","orgId":"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8","shortName":"OTRS"},"references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-03/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to OTRS 2026.4.1. or later. Please note that there will be no OTRS 7 patches<br>"}],"value":"Update to OTRS 2026.4.1. or later. Please note that there will be no OTRS 7 patches"}],"source":{"advisory":"OSA-2026-03","defect":["Ticket#2026052110000161","Issue#3780"],"discovery":"USER"},"title":"Bypass DedicatedAgentToCustomerGroups Setting","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8","assignerShortName":"OTRS","cveId":"CVE-2026-48189","datePublished":"2026-06-01T03:33:03.373Z","dateReserved":"2026-05-21T07:53:13.254Z","dateUpdated":"2026-06-01T03:33:03.373Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-01 04:16:22","lastModifiedDate":"2026-06-01 04:16:22","problem_types":["CWE-200","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":{"cvssMetricV31":[{"source":"security@otrs.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"48189","Ordinal":"1","Title":"Bypass DedicatedAgentToCustomerGroups Setting","CVE":"CVE-2026-48189","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"48189","Ordinal":"1","NoteData":"An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature has to be anabled and CustomerGroupSupport has to be used to be affected.\n\nThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.4.X","Type":"Description","Title":"Bypass DedicatedAgentToCustomerGroups Setting"}]}}}