The vulnerability arises from the Agent Frontend configuration endpoint in OTRS, which is reachable without authentication. Users who can access the endpoint can retrieve internal configuration data, including frontend routes, authorization groups, authentication settings, enabled features, third‑party integrations, and other implementation details. While this information does not expose credentials or directly allow configuration changes, it can assist an attacker in fingerprinting the installation and identifying security‑relevant functionality that could be leveraged in subsequent attacks. This is a CWE-497 Information Disclosure vulnerability.

OTRS GmbH’s OTRS product is affected. The vulnerability applies to all installations of OTRS versions 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x prior to the 2026.7.x release. No OTRS 7 patches will address this issue.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the unauthenticated endpoint remotely to gather internal configuration. The exposed data could aid reconnaissance activities, helping attackers identify enabled features or misconfigurations that may be targeted in later stages of an attack. Although it does not permit direct configuration changes or credential theft, the information leak increases the attack surface for future threats.