OTRS Cross-Backend Identity Reuse Vulnerability (CVE-2026-7559)

Vulnerability Overview Vulnerability ID: OSA-2026-16 Publication Date: 2026-10-12 Title: Duplicate Identity/Identity Shadowing Across CustomerUser Backends CVSS v3.1 Score: 5.4 (Medium) CVSS v4.0 Score: 5.3 (Medium) Severity: Medium Affected Product: OTRS (Community Edition) Fixed Version: OTRS 2026.7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N References: CVE-2026-7559 Affected Scope Affected Versions: - 7.0.x - 8.0.x - 2023.x - 2024.x - 2025.x - 2026.x (prior to 2026.7.1) Problem Description: - OTRS fails to sufficiently enforce uniqueness of CustomerUser identities across multiple configured CustomerUser backends. When multiple backends (e.g., database and LDAP) are configured, uniqueness checks for CustomerUser email addresses are performed only within the selected backend. Consequently, authenticated users with permission to create or modify CustomerUsers may create CustomerUser records with email addresses already assigned to a CustomerUser in another backend. - This can result in multiple CustomerUser records representing the same communication identity. Depending on the affected workflows and backend re-binding, customer-related information or email communications may subsequently be associated with or exposed to the incorrect CustomerUser. - The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify CustomerUsers. Issues: - CWE-694: Use of Duplicate Identifiers for Multiple Resources - CWE-706: Use of Incorrectly Resolved Name or Reference Impact: - CAPEC-151: Identity Impersonation Remediation Solution: - Upgrade to the latest version of OTRS (2026.7.1 or later). Note that no patches will be released for OTRS 7. Additional Information PGP Key: - pub 2048R/9C227C6B 2011-03-21 - uid OTRS Security Team - GPG Fingerprint: E330 4608 DA6E 34B7 1551 C244 799E 44E9 9C22 7C6B Acknowledgments: - Special thanks to Marc Worsken for reporting this vulnerability. Code Block No POC code or exploitation code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

OTRS Cross-Backend Identity Reuse Vulnerability (CVE-2026-7559)