CVE-2026-78358

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed. Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself.  Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site request, the response content remains subject to the browser's same-origin restrictions and is not automatically exposed to the attacker. Therefore, no direct confidentiality impact has been demonstrated for these endpoints. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

• CWE-352

• https://otrs.com/release-notes/otrs-security-advisory-2026-15/

Published

Oct 12, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78340Dell Secure Connect Gateway (SCG) Policy Manager, versions p…6.7
• CVE-2026-78341Dell Secure Connect Gateway (SCG) Policy Manager, versions p…7.2
• CVE-2026-7835A format string argument mismatch in Netatalk 3.0.3 through …3.1
• CVE-2026-78355A path traversal vulnerability in the OTRS SendSupportBundle…8.7
• CVE-2026-78356The OTRS Agent Frontend configuration endpoint can be access…5.3
• CVE-2026-78357Previously issued authentication tokens are not immediately …9.1
• CVE-2026-78359OTRS does not sufficiently enforce the uniqueness of custome…5.4
• CVE-2026-7836An incorrect calculation in the hextoint macro in Netatalk 2…3.1
• CVE-2026-78361The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPre…9.1
• CVE-2026-78362The SEO Flow by LupsOnline WordPress plugin before 3.0.3 doe…9.8
• CVE-2026-78363The MW WP Form WordPress plugin before 5.1.5 does not preven…4.8
• CVE-2026-78364The MW WP Form WordPress plugin before 5.1.6 does not saniti…3.5