CVE Intelligence
Analysis AI-assisted

CVE-2026-48188: OTRS Community Edition SQL Injection via MySQL Quote Method

A critical unauthenticated SQL injection in the database layer of OTRS and ((OTRS)) Community Edition can lead to authentication bypass, with a CVSS 3.1 score of 9.1 in the record. The issue only applies when the MySQL or MariaDB server runs with the NO_BACKSLASH_ESCAPES SQL mode. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-48188 is a critical SQL injection issue in the database layer of OTRS and the ((OTRS)) Community Edition, classified as CWE-20 (Improper Input Validation). The record states that it can be reached without authentication and can lead to an authentication bypass.

Impact

  • The record describes unauthenticated SQL injection that can lead to an authentication bypass.
  • The CVSS 3.1 base score in the record is 9.1 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which indicates network reachability, no privileges required and no user interaction.
  • The record says the issue only affects systems where the MySQL or MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.

Affected products and versions

According to the record, the following are affected:

  • OTRS: versions 7.0.x, 8.0.x, 2023.x, 2024.x and 2025.x; versions 6.0.32 and earlier; versions from 7.0.0 up to and including 8.0.37; versions from 2023.0.0 before 2026.4.1; and versions from 2026.x up to and including 2026.3.x.
  • ((OTRS)) Community Edition: version 6.x, as listed in the record.
  • Products based on the ((OTRS)) Community Edition are described as very likely affected, but they are not enumerated.

The record lists no explicit fixed version. The affected ranges end before 2026.4.1, which is a boundary in the record and not a confirmed fix entry.

Exploitation status

  • The CISA KEV catalog entry in the record is not listed.
  • The SSVC exploitation value in the record is none, and the automatable value is yes.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The EPSS probability in the record is 0.00489, with a percentile of 0.41202.

Remediation and mitigation

  • Review the vendor security advisory and determine whether your OTRS or ((OTRS)) installation falls within the affected ranges.
  • Plan an upgrade to a version the vendor identifies as fixed. The record does not name the fixed build, so confirm it in the vendor advisory.
  • Until patched, check whether the MySQL or MariaDB servers run with NO_BACKSLASH_ESCAPES enabled and treat this as a priority factor in risk assessment. Test any change to server SQL mode settings before applying it.
  • Limit network exposure of the OTRS web interface where feasible.

Detection guidance

  • Review application and database logs for SQL errors or unusual query patterns around login and authentication flows.
  • Look for unexpected successful administrative logins, especially from unfamiliar sources.
  • Confirm the sql_mode settings on every MySQL or MariaDB server that backs OTRS.
  • The sources do not provide detection rules, so any detection logic must be validated locally.

Limitations of the available information

  • The record does not list a fixed version or a patch entry.
  • The sources consulted do not provide technical details beyond the record description.
  • The record does not provide a complete list of products derived from the ((OTRS)) Community Edition.
  • The CVSS data comes from the CNA and appears twice in the record with the same values.

Frequently asked questions

What is CVE-2026-48188?

It is a critical SQL injection issue in the database layer of OTRS and ((OTRS)) Community Edition that the record says can be reached without authentication and can lead to authentication bypass.

Does this issue affect every OTRS installation?

According to the record, it only affects systems where the MySQL or MariaDB server uses the NO_BACKSLASH_ESCAPES SQL mode. Products based on ((OTRS)) Community Edition are described as very likely affected.

Is this vulnerability known to be exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.