CVE-2026-48188

The vulnerability results from improper input validation in the database layer module. An attacker can submit a crafted query containing a malicious SQL payload without needing to possess any privileges. The attack is only possible when the MySQL or MariaDB server is configured with the SQL NO_BACKSLASH_ESCAPES mode — in this mode, the standard backslash escape mechanism is disabled, which prevents the application from effectively neutralizing malicious input strings. This allows manipulation of SQL queries and bypassing user identity verification.

An attacker without any privileges can gain unauthorized access to the OTRS system by bypassing the login mechanism, leading to high violation of confidentiality and integrity of processed data.

OTRS should be updated to version 2026.4.X or newer. For other branches (7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X) and OTRS Community Edition 6.0.x, patches available from the vendor should be applied according to the references (https://otrs.com/release-notes/otrs-security-advisory-2026-02/). As an immediate workaround, removing the NO_BACKSLASH_ESCAPES mode from the MySQL/MariaDB server configuration can be considered if operationally acceptable.

OTRS in versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X; OTRS Community Edition in version 6.0.x; products based on OTRS Community Edition are likely also vulnerable. The vulnerability is revealed only when the MySQL/MariaDB server is configured with the SQL NO_BACKSLASH_ESCAPES mode.