CVE-2026-78359— Duplicate Identity / Identity Shadowing across CustomerUser backends
Quick assessment
Affected
OTRS GmbH (former OTRS AG) OTRS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OTRS 未充分跨多个配置的客户用户后端强制执行客户用户身份的唯一性。当配置了多个后端（例如数据库和 LDAP）时，客户用户电子邮件地址的唯一性检查仅在所选的后端内进行。因此，拥有创建或修改客户用户权限的已认证用户，可以创建一个其电子邮件地址已分配给另一后端中客户用户的客户用户。 这可能导致多个客户用户记录代表相同的通信身份。根据受影响的工作流程和後端解析机制，客户相关信息或电子邮件通信随后可能会错误地关联到或暴露给错误的客户用户。 该漏洞不允许未认证的用户创建客户账户。利用此漏洞需要拥有创建或修改客户用户的权限。
Possible ATT&CK Techniques 1 AI
T1136 · Create AccountAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OTRS GmbH (former OTRS AG) | ((OTRS)) Community Edition | 6.x |
affected |
| OTRS GmbH (former OTRS AG) | OTRS | 7.0.x |
affected |
8.0.x |
affected | ||
2023.x |
affected | ||
2024.x |
affected | ||
2025.x |
affected | ||
2026.x≤ 2026.6.x |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78359
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Duplicate Identity / Identity Shadowing across CustomerUser backends
Source: CVE Program / CVE List V5
Vulnerability Description
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend.
This can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user.
The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify customer users.
This issue affects OTRS:
* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.7.X
Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用多个具有重复标识的资源
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OTRS GmbH (former OTRS AG) | OTRS | 7.0.x | - |
|
| OTRS GmbH (former OTRS AG) | ((OTRS)) Community Edition | 6.x | - |
|
II. Public POCs for CVE-2026-78359
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78359
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78359 (1)
Same Patch Batch · OTRS GmbH (former OTRS AG) · 2026-10-12 · 9 CVEs total
| CVE-2026-93582 | 9.4 CRITICAL | Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication |
| CVE-2026-78357 | 9.1 CRITICAL | Insufficient Session Revocation for JWT Authentication |
| CVE-2026-78355 | 8.7 HIGH | Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory |
| CVE-2026-93581 | 6.1 MEDIUM | Insufficient Neutralization of Formula Elements in CSV Exports |
| CVE-2026-48211 | 5.4 MEDIUM | Cross-Site Request Forgery in Import/Export Admin console |
| CVE-2026-78356 | 5.3 MEDIUM | Unauthenticated Disclosure of Agent Frontend Configuration |
| CVE-2026-48212 | 4.8 MEDIUM | Stored XSS in external pages |
| CVE-2026-78358 | 4.3 MEDIUM | Cross-Site Request Forgery in Administrative Actions |
IV. Related Vulnerabilities
Same product: OTRS
-
CVE-2026-93582
Authentication Bypass via Spoofed Remote-User Header in HTTP -
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Expor -
CVE-2026-78358
Cross-Site Request Forgery in Administrative Actions -
CVE-2026-78357
Insufficient Session Revocation for JWT Authentication -
CVE-2026-78356
Unauthenticated Disclosure of Agent Frontend Configuration
Same vendor: OTRS GmbH (former OTRS AG)
-
CVE-2026-93582
Authentication Bypass via Spoofed Remote-User Header in HTTP -
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Expor -
CVE-2026-78358
Cross-Site Request Forgery in Administrative Actions -
CVE-2026-78357
Insufficient Session Revocation for JWT Authentication -
CVE-2026-78356
Unauthenticated Disclosure of Agent Frontend Configuration
Same weakness: CWE-694
-
CVE-2026-108752
JupyterHub through 6.0.1 OAuth Client ID Collision via Unesc -
CVE-2026-102634
SGLang through 0.5.20 Denial of Service via Duplicate bootst -
CVE-2026-71327
Traefik: Gateway API route identity collision allows cross-n -
CVE-2026-57024
Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation -
CVE-2026-5794
Vulnerability in Cryptobox allows an authenticated user to t
V. Comments for CVE-2026-78359
No comments yet