An incorrect handling of file system and configuration permissions in the STORM-powered Document Search Article Meta Filters module of OTRS allows an attacker to learn the number of affected configuration items, service level agreements and services. The flaw is an insecure permission setting (CWE‑276) that exposes metadata to users who should not have that level of insight, potentially aiding further reconnaissance or targeted attacks.

Vendors: OTRS AG; Product: OTRS. Affected versions include OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and all 2026.X releases prior to 2026.4.X, specifically when the STORM modules are installed.

The CVSS score is 3.5, indicating low‑to‑moderate impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that publicly known exploit code is scarce. The likely attack vector is through the web interface or internal user privileges, where an authenticated or partially privileged attacker could query the affected meta filters and infer sensitive management data. Exploitation does not require privilege escalation or code execution but relies on misconfigured permissions.