The vulnerability allows an unauthenticated remote attacker to craft a request that is executed with the privileges of an active administrator session. By exploiting the missing ChallengeToken validation in the Import/Export delete action, the attacker can delete administrative import/export templates, potentially disrupting workflows or configuration backups. The impact is limited to the deletion of these templates, but it can compromise system stability and data integrity for administrators. The flaw is a classic CSRF weakness (CWE‑352).

The affected products are OTRS by OTRS GmbH, including the OTRS Community Edition and the commercial OTRS system. Vulnerable versions include: OTRS 7.0.x, OTRS 8.0.x, OTRS 2023.x, OTRS 2024.x, OTRS 2025.x, and all 2026.x releases before 2026.7.x. Community Edition 6.x and earlier are also affected, and other products derived from Community 6.x are likely vulnerable.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a target user authenticated as an administrator, so the attack vector is more plausibly a targeted CSRF from a malicious page. While the likelihood of widespread exploitation is moderate, organizations with administrators who are frequently online or who lack CSRF protections should treat this as a priority for patching.