CVE-2026-48209: Reflected XSS in authenticated agent context

Synopsis

Reflected cross-site scripting (XSS) affects OTRS and ((OTRS)) Community Edition ticket handling. The vulnerability is reachable over the network and requires no authentication to craft and deliver the malicious link, but a victim agent must open it, executing arbitrary JavaScript in the context of their authenticated session. Successful exploitation allows an attacker to read session data and make high-impact modifications to ticket data on behalf of the authenticated agent. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted URL over the network; the target service must be reachable by the victim's browser to complete the attack.

• AuthenticationNot required

  No credentials are needed to construct and deliver the malicious link; the attacker exploits the victim's existing authenticated session.

• Victim interactionRequired

  An authenticated OTRS agent must open the attacker-crafted URL, making social engineering (phishing, chat link, email) a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental factors to succeed.

Blast Radius

• An attacker can read session tokens and any ticket data visible in the agent's browser context.
• The attacker can make high-impact modifications to ticket records, assignments, or statuses by executing JavaScript on behalf of the agent.
• Confidential information rendered in the agent interface, including customer communications and internal notes, is exposed to the injected script.