The vulnerability is an improper input validation flaw in the OTRS Customer Backend module that allows an attacker to read customer information that should be restricted to other groups. Because the flaw only manifests when the CustomerGroupSupport feature is enabled, users must enable this option for the risk to materialize. The primary impact is the unauthorized disclosure of customer data, which can lead to privacy violations and potential downstream exploitation of personal information. The weakness is classified as CWE‑200, a confidentiality breach.

The issue exists in OTRS AG’s OTRS platform for the following releases: 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and all 2026.x versions prior to 2026.4.x. Anyone running these versions with CustomerGroupSupport enabled is vulnerable.

The CVSS score of 5.7 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread, confirmed exploitation at this time. Based on the description, the likely attack vector is through standard web requests to the Customer Backend module; an attacker would need to craft a request that takes advantage of the unchecked input validation. No additional authentication requirements are specified, so the exploit may be performed by an authenticated or unauthenticated user depending on configuration, but it still requires the CustomerGroupSupport feature to be active.