CVE-2026-78359

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend. This can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user. The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify customer users. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

• CWE-694
• CWE-706

• https://otrs.com/release-notes/otrs-security-advisory-2026-16/

Published

Oct 12, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78341Dell Secure Connect Gateway (SCG) Policy Manager, versions p…7.2
• CVE-2026-7835A format string argument mismatch in Netatalk 3.0.3 through …3.1
• CVE-2026-78355A path traversal vulnerability in the OTRS SendSupportBundle…8.7
• CVE-2026-78356The OTRS Agent Frontend configuration endpoint can be access…5.3
• CVE-2026-78357Previously issued authentication tokens are not immediately …9.1
• CVE-2026-78358Several administrative actions do not sufficiently validate …4.3
• CVE-2026-7836An incorrect calculation in the hextoint macro in Netatalk 2…3.1
• CVE-2026-78361The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPre…9.1
• CVE-2026-78362The SEO Flow by LupsOnline WordPress plugin before 3.0.3 doe…9.8
• CVE-2026-78363The MW WP Form WordPress plugin before 5.1.5 does not preven…4.8
• CVE-2026-78364The MW WP Form WordPress plugin before 5.1.6 does not saniti…3.5
• CVE-2026-78365Authorization Bypass Through User-Controlled Key in the supp…9.3