CVE-2026-48188
CVE-2026-48188 is a critical SQL injection vulnerability in OTRS and its Community Edition. It allows unauthenticated attackers to bypass authentication if the MySQL/MariaDB server uses the NO_BACKSLASH_ESCAPES SQL mode. Affected versions include OTRS 7.0.X through 2026.4.X and Community Edition 6.0.x.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X (before 2026.4.X), and ((OTRS)) Community Edition 6.0.x. Products based on the Community Edition are also likely affected.
Real-world impact
Unauthenticated attackers could exploit this to bypass authentication, potentially gaining unauthorized access to systems.
Why this severity
CVSS 9.1 (critical) due to high confidence in exploitation and potential for full system compromise.
What to do about it
- ›Disable the NO_BACKSLASH_ESCAPES SQL mode in MySQL/MariaDB configurations to prevent the vulnerability from being triggered.
- ›Avoid using vulnerable OTRS or Community Edition versions until an official patch is available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description and affected product data
Timeline
- Jun 1, 2026 · Jun 1, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- otrs.com/release-notes/otrs-security…vendor advisory