Otrs CVE-2026-6060

Exploitation requires high-privilege administrator access to the OTRS admin interface (PR:H per CVSS vector) and successful authentication to the webserver. The SQL Box feature must be enabled (likely default in standard OTRS deployments). The attacker must trigger query execution through the web interface (UI:R - user interaction, meaning the admin must click 'Execute' or similar). No special SQL syntax, database configuration, or OTRS feature flags are mentioned in the description, suggesting the vulnerability is inherent to the SQL Box design rather than tied to non-default settings. Exploitation is limited to authenticated high-privilege users; unauthenticated remote users cannot reach the SQL Box functionality.

The CVSS 4.5 score (medium severity) with network vector (AV:N) reflects realistic constraints that significantly limit practical risk. The attack requires PR:H (high privilege - admin access) and UI:R (user interaction), which substantially narrows the threat model: an attacker must either compromise an existing admin account or conduct social engineering against authorized administrators. The availability impact (A:H) is severe only if exploited, but the high privilege requirement means this is an insider-risk or post-compromise scenario rather than a broad public-facing threat. No EPSS score is provided, but KEV status is not mentioned, and no POC is referenced, suggesting this has not been weaponized or broadly exploited. The real-world risk is lower than the CVSS base score suggests because the attack vector and privilege requirements sharply restrict the attacker population. This is a legitimate priority for OTRS administrators to patch, but not a critical incident-response priority for organizations with strong admin credential controls.

An authenticated OTRS administrator, either compromised by credential theft or acting maliciously, accesses the admin interface and navigates to the SQL Box tool. The attacker crafts a computationally expensive SQL query (e.g., a Cartesian product join without limits or a recursive CTE without termination conditions) and executes it through the web interface. The uncontrolled query consumes CPU and memory resources on the webserver, causing legitimate user requests to timeout and triggering service degradation or restart.