CVE-2026-48191
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules, incorrect permission handling allows gaining knowledge about the number of affected CIs, SLA, and services without gaining access to them.
Risk Assessment
An attacker can learn sensitive infrastructure information (e.g., number of CIs, SLAs), which may aid in planning further attacks.
Recommendation
Update OTRS with STORM modules to version 2026.4.X or later.
Original NVD description (English source)
An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This issue affects OTRS with STORM modules: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X