CVE-2026-48212

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48212", "assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8", "state": "PUBLISHED", "assignerShortName": "OTRS", "dateReserved": "2026-05-21T12:12:49.646Z", "datePublished": "2026-10-12T06:48:50.387Z", "dateUpdated": "2026-10-15T18:07:57.247Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["External Interface"], "product": "OTRS", "vendor": "OTRS GmbH (former OTRS AG)", "versions": [{"status": "affected", "version": "7.0.x"}, {"status": "affected", "version": "8.0.x"}, {"status": "affected", "version": "2023.x"}, {"status": "affected", "version": "2024.x"}, {"status": "affected", "version": "2025.x"}, {"lessThanOrEqual": "2026.6.x", "status": "affected", "version": "2026.x", "versionType": "patch"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Special thanks to William Bastos (@chor4o) and Samara Gama (igobysamy) for reporting this vulnerability"}], "datePublic": "2026-10-12T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.<br></div><div><p>This issue affects OTRS:</p><ul><li>7.0.X</li><li>8.0.X</li><li>2023.X</li><li>2024.X</li><li>2025.X</li><li>2026.X before 2026.7.X</li></ul><br></div>"}], "value": "An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.\n\nThis issue affects OTRS:\n\n * 7.0.X\n * 8.0.X\n * 2023.X\n * 2024.X\n * 2025.X\n * 2026.X before 2026.7.X"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8", "shortName": "OTRS", "dateUpdated": "2026-10-12T06:48:50.387Z"}, "references": [{"url": "https://otrs.com/release-notes/otrs-security-advisory-2026-11/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to latest version of OTRS (2026.7.1. or later). Please note that there will be no OTRS 7 patches<br>"}], "value": "Update to latest version of OTRS (2026.7.1. or later). Please note that there will be no OTRS 7 patches"}], "source": {"advisory": "OSA-2026-11", "defect": ["SecOPS#2026062210000078", "Issue#5090"], "discovery": "EXTERNAL"}, "title": "Stored XSS in external pages", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T17:51:34.895193Z", "id": "CVE-2026-48212", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T18:07:57.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48212", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T17:51:34.895193Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T17:51:35.562Z"}}], "cna": {"title": "Stored XSS in external pages", "source": {"defect": ["SecOPS#2026062210000078", "Issue#5090"], "advisory": "OSA-2026-11", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Special thanks to William Bastos (@chor4o) and Samara Gama (igobysamy) for reporting this vulnerability"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OTRS GmbH (former OTRS AG)", "modules": ["External Interface"], "product": "OTRS", "versions": [{"status": "affected", "version": "7.0.x"}, {"status": "affected", "version": "8.0.x"}, {"status": "affected", "version": "2023.x"}, {"status": "affected", "version": "2024.x"}, {"status": "affected", "version": "2025.x"}, {"status": "affected", "version": "2026.x", "versionType": "patch", "lessThanOrEqual": "2026.6.x"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Update to latest version of OTRS (2026.7.1. or later). Please note that there will be no OTRS 7 patches", "supportingMedia": [{"type": "text/html", "value": "Update to latest version of OTRS (2026.7.1. or later). Please note that there will be no OTRS 7 patches<br>", "base64": false}]}], "datePublic": "2026-10-12T07:00:00.000Z", "references": [{"url": "https://otrs.com/release-notes/otrs-security-advisory-2026-11/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.\n\nThis issue affects OTRS:\n\n * 7.0.X\n * 8.0.X\n * 2023.X\n * 2024.X\n * 2025.X\n * 2026.X before 2026.7.X", "supportingMedia": [{"type": "text/html", "value": "<div>An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.<br></div><div><p>This issue affects OTRS:</p><ul><li>7.0.X</li><li>8.0.X</li><li>2023.X</li><li>2024.X</li><li>2025.X</li><li>2026.X before 2026.7.X</li></ul><br></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8", "shortName": "OTRS", "dateUpdated": "2026-10-12T06:48:50.387Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48212", "state": "PUBLISHED", "dateUpdated": "2026-10-15T18:07:57.247Z", "dateReserved": "2026-05-21T12:12:49.646Z", "assignerOrgId": "2e1bf29f-dc29-4ed8-830c-7b9348b6f0e8", "datePublished": "2026-10-12T06:48:50.387Z", "assignerShortName": "OTRS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["External Interface"], "product": "OTRS", "vendor": "OTRS GmbH (former OTRS AG)", "versions": [{"status": "affected", "version": "7.0.x"}, {"status": "affected", "version": "8.0.x"}, {"status": "affected", "version": "2023.x"}, {"status": "affected", "version": "2024.x"}, {"status": "affected", "version": "2025.x"}, {"lessThanOrEqual": "2026.6.x", "status": "affected", "version": "2026.x", "versionType": "patch"}]}], "source": "security@otrs.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.\n\nThis issue affects OTRS:\n\n * 7.0.X\n * 8.0.X\n * 2023.X\n * 2024.X\n * 2025.X\n * 2026.X before 2026.7.X"}], "id": "CVE-2026-48212", "lastModified": "2026-10-15T20:38:44.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "security@otrs.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48212", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T17:51:34.895193Z", "version": "2.0.3"}}]}, "published": "2026-10-12T07:16:36.610", "references": [{"source": "security@otrs.com", "url": "https://otrs.com/release-notes/otrs-security-advisory-2026-11/"}], "sourceIdentifier": "security@otrs.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@otrs.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.x"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8.0.x"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2023.x"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2024.x"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2025.x"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2026.x,2026.6.x]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OTRS", "source": "cna", "vendor": "OTRS GmbH (former OTRS AG)"}, "product": "otrs", "vendor": "otrs"}], "created": "2026-10-12T08:30:07.059034+00:00", "updated": "2026-10-12T09:15:09.404877+00:00", "vendors": ["otrs", "otrs$PRODUCT$otrs"]}