An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the "Is visible for customer" flag by default, preventing users from disabling it through the UI. This results in unintended exposure of internal ticket information to the external frontend, allowing users who forward ticket articles to disclose sensitive content that is meant to remain confidential.

The vulnerability affects OTRS, a ticketing system from OTRS AG, specifically version 2026.3.1. Any deployments of this version that allow ticket article forwarding are susceptible to the disclosed data leak.

The CVSS score of 5.7 indicates a moderate severity. Since the EPSS score is not available and the issue is not listed in CISA KEV, the likelihood of widespread exploitation is not well quantified, but any logged‑in user who forwards a ticket may inadvertently expose sensitive information. The attack path is straightforward: a user initiates a forward action via the web interface, the system automatically sets the visibility flag to true, and internal data becomes visible to external front‑end users.