Duplicate Identity / Identity Shadowing across CustomerUser backends
CVSS score
5.4
EPSS probability
—
Risk score
0.5
Published
9 h ago
Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
1
Source agreement
Tam uyum
Evidence confidence
%55
Short explanation
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends (S0). When multiple backends are configured, the uniqueness check for email addresses is performed only within the selected backend (S0). Consequently, an authorized user may create a customer user whose email is already assigned in another backend (S0).
This vulnerability can cause customer-related information or email communication to be associated with or exposed to the wrong user (S0). Unauthenticated users cannot create accounts, but exploitation requires permissions to create or modify customer users (S0).
What should be done?
- Follow the vendor advisory (S0)
- Apply updates to OTRS versions (S0)
Chain of evidence and sources
OTRS, birden fazla CustomerUser arka ucu yapılandırıldığında müşteri kullanıcı e-postalarının benzersizliğini yalnızca seçilen arka uçta kontrol eder.
İstismar, müşteri kullanıcıları oluşturma veya değiştirme izinlerine sahip kimliği doğrulanmış bir kullanıcıyı gerektirir.
Show the technical text from the sources
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend. This can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user. The vulnerability does not allow unauthenticated users to create customer accounts. Exploitation requires permissions to create or modify customer users. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE: CWE-694, CWE-706
Explanation produced with the local gemini-flash-lite-latest model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 5.4 | CVSS V3_1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | CVE CNA |
| 5.4 | CVSS V31 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | NVD |
Patch and Remediation Guide
Solution & Remediation Advisory
İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-78359 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-78359 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
CVSS Vector Radar Chart
5.4 / 10Vulnerability Scoring Details
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NYama durumu bilinmiyor
Weakness Type (CWE & CAPEC)
Similar Vulnerabilities
Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
Insufficient Session Revocation for JWT Authentication
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
Insufficient Neutralization of Formula Elements in CSV Exports
Cross-Site Request Forgery in Import/Export Admin console
Unauthenticated Disclosure of Agent Frontend Configuration
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-78359"