OTRS

Latest CVEs · RSS

• CVE-2026-93582 2026-10-12 · CVSS 9.4
  The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USE
• CVE-2026-93581 2026-10-12 · CVSS 6.1
  User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authentica
• CVE-2026-78359 2026-10-12 · CVSS 5.4
  OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as
• CVE-2026-78358 2026-10-12 · CVSS 4.3
  Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdate
• CVE-2026-78357 2026-10-12 · CVSS 9.1
  Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. A
• CVE-2026-78356 2026-10-12 · CVSS 5.3
  The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application
• CVE-2026-78355 2026-10-12 · CVSS 8.7
  A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended di
• CVE-2026-48212 2026-10-12 · CVSS 4.8
  An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in th
• CVE-2026-48211 2026-10-12 · CVSS 5.4
  An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS Admi
• CVE-2026-48187 2026-06-01 · CVSS 5.7
  An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion o
• CVE-2026-48188 2026-06-01 · CVSS 9.1
  An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to
• CVE-2026-48189 2026-06-01 · CVSS 5.7
  An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please no
• CVE-2026-48190 2026-06-01 · CVSS 3.5
  An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI infor
• CVE-2026-48191 2026-06-01 · CVSS 3.5
  An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowled
• CVE-2026-48208 2026-06-01 · CVSS 6.5
  An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG
• CVE-2026-48209 2026-06-01 · CVSS 7.1
  An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected
• CVE-2026-48210 2026-05-31 · CVSS 5.7
  An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent
• CVE-2026-6060 2026-04-20 · CVSS 4.5
  A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be kill
• CVE-2025-24391 2025-07-14 · CVSS 5.3
  A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and
• CVE-2025-24388 2025-06-16 · CVSS 3.8
  A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin u
• CVE-2025-24387 2025-03-10 · CVSS 4.8
  A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an
• CVE-2025-24390 2025-01-27 · CVSS 6.8
  A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS
• CVE-2025-24389 2025-01-27 · CVSS 6.3
  Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system
• CVE-2024-43446 2025-01-27 · CVSS 3.5
  An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. T
• CVE-2024-43445 2025-01-27 · CVSS 5.4
  A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exp