CVE-2026-48191

{"id": "CVE-2026-48191", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@otrs.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2026-06-01T04:16:22.983", "references": [{"url": "https://otrs.com/release-notes/otrs-security-advisory-2026-05/", "tags": ["Vendor Advisory"], "source": "security@otrs.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@otrs.com", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them.\n\nThis issue affects OTRS with STORM modules: \n\n * 7.0.X\n * 8.0.X\n * 2023.X\n * 2024.X\n * 2025.X\n * 2026.X before 2026.4.X"}], "lastModified": "2026-06-15T12:42:03.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "650E99BF-9E05-496F-BD59-5542A95FD221", "versionEndIncluding": "8.0.37", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "476B2F02-24EA-43BB-BEA8-282D7D71B386", "versionEndExcluding": "2026.4.1", "versionStartIncluding": "2023.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@otrs.com"}