AT Several administrative endpoints in OTRS do not validate a ChallengeToken. The DBUpdateLogCleanUp operation can be triggered via a simple GET request, allowing an unauthenticated remote attacker to cause the browser of a logged‑in administrator to delete existing DBUpdate log entries. This loss reduces the availability of diagnostic and audit history and can be leveraged against any other administrative endpoints that lack token validation, potentially allowing deployment of pre‑existing configurations. The vulnerability is a classic CSRF attack (CWE‑352). No direct confidentiality impact has been demonstrated for exported or read‑only endpoints because the browser’s same‑origin policy prevents the attacker from capturing response data.

The flaw affects OTRS GmbH products, including the Community Edition and the standard OTRS installation. Vulnerable from version 7.0.X through 2026.X prior to 2026.7.X. Community Edition 6.x and earlier are included. Products derived from the Community Edition are also likely affected.

With a CVSS score of 4.3, the vulnerability is considered moderate. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, indicating no current public exploitation evidence. The attack requires the victim to be an authenticated administrator whose browser is tricked into visiting a malicious web page that issues an unauthenticated GET request to the vulnerable endpoint. Successful exploitation results in deletion of existing DBUpdate logs, which impacts system diagnostics but does not grant arbitrary code execution or direct data leakage.