CVE-2026-48191
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Wrong Permission Handling in Document Search Article Meta Filters
An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This issue affects OTRS with STORM modules: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
OTRS
- Vendor
- OTRS AG
- Product
- OTRS
- Platforms
- Unknown
- Default status
unknown- Package
- STORM
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 7.0.x | unknown | Unavailable | Unavailable | Unavailable | None listed |
| 8.0.x | affected | Unavailable | Unavailable | Unavailable | None listed |
| 2023.x | affected | Unavailable | Unavailable | Unavailable | None listed |
| 2024.x | affected | Unavailable | Unavailable | Unavailable | None listed |
| 2025.x | affected | Unavailable | Unavailable | Unavailable | None listed |
| 2026.x | affected | patch | Unavailable | 2026.3.x | None listed |