Otrs Community Edition
Monthly
Authentication bypass in ((OTRS)) Community Edition 6.x and earlier lets an unauthenticated remote attacker impersonate any existing agent or customer account when HTTP Basic Authentication is the configured authentication backend. Because the CGI/mod_perl deployment maps an attacker-supplied 'Remote-User' request header into the HTTP_REMOTE_USER environment variable, OTRS treats that header value as an already-authenticated username and skips password verification, after which the Generic Interface can be accessed with the impersonated account's privileges. Exploitation is not unconditional: it requires Basic Auth to be the active backend, a CGI/mod_perl (not Mojolicious/Hypnotoad) deployment, and knowledge of a valid target username, which is why an independent assessment rates the attack complexity as High (AC:H) rather than the vendor's AC:L, and no public exploit code was identified at time of analysis. OTRS 7 and later are unaffected by this vector.
Path traversal in the OTRS SendSupportBundle functionality allows an authenticated administrator to delete files outside the intended directory, limited by the operating system permissions of the OTRS application process. The issue affects OTRS versions 7.0.X through 2026.X before 2026.7.X, as well as ((OTRS)) Community Edition 6.x and earlier; products based on Community Edition are likely affected. Despite a high CVSS score of 8.7, exploitation requires a valid administrative account and does not bypass OS file permissions, and no public exploit has been identified.
Unauthenticated SQL injection in OTRS and the legacy ((OTRS)) Community Edition database layer enables authentication bypass when the backing MySQL/MariaDB instance runs with the NO_BACKSLASH_ESCAPES SQL mode. The flaw carries a CVSS of 9.1 with network-reachable, no-privileges-required exploitation against confidentiality and integrity, but no public exploit identified at time of analysis and the issue is gated by a specific non-default database configuration.
Reflected cross-site scripting in OTRS 7.0.x and ((OTRS)) Community Edition 6.x and earlier allows remote attackers to execute arbitrary JavaScript in an authenticated agent's browser session by tricking the agent into clicking a crafted ticket-action URL. The CVSS 7.1 (UI:R) rating reflects the need for victim interaction, and no public exploit identified at time of analysis, but the high integrity impact and the ubiquity of OTRS-derived help-desk forks make this a meaningful risk for ticketing environments.
CSV export formula injection in OTRS (7.0.X, 8.0.X, and 2023.X through 2026.X before 2026.7.X, plus legacy ((OTRS)) Community Edition 6.x and products derived from it) lets attacker-influenced text that lands in ticket or contact fields be written into exported CSV files as spreadsheet formulas starting with =, +, -, or @, so that opening the export in Excel or similar software can cause unintended actions, information disclosure, or invocation of external functionality inside the spreadsheet client. Rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the issue is unauthenticated from the network perspective per the vector, since a payload can arrive through external channels such as inbound email routed into an OTRS queue rather than requiring a valid account; the real limiting factors are that an export workflow must actually be used and the recipient must generally confirm one or more spreadsheet security-warning dialogs before a formula executes. Only the victim's spreadsheet application is affected, no code executes on the OTRS server, and no public exploit identified at time of analysis with no CISA KEV listing.
Duplicate customer-identity records can be created in OTRS whenever more than one CustomerUser backend is configured (for example a database backend alongside LDAP), because the email-address uniqueness check is applied only within the backend selected at the time of creation rather than across all backends. An authenticated operator holding the permission to create or modify customer users (PR:L per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 5.4) can therefore register an address already assigned to a customer in another backend, after which ticket records or outgoing email may be associated with, or exposed to, the wrong customer identity. Exploitability is narrowed by two prerequisites - a non-default multi-backend CustomerUser configuration and a privileged customer-user management role - so this is a genuine but moderate-priority integrity and information-exposure issue rather than an urgent emergency; no public exploit identified at time of analysis and no CISA KEV listing.
Cross-site request forgery in OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and 2026.X before 2026.7.X lets an unauthenticated remote attacker cause an authenticated administrator's browser to fire the DBUpdateLogCleanUp administrative action through a forged GET request, deleting the DBUpdate log entries present at the time the request is processed and degrading diagnostic and audit history. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) exploitation requires an administrator with an active session to be lured into loading an attacker-controlled page, so the attacker cannot choose targets or confirm success, and no public exploit code was identified at time of analysis. Additional administrative, deployment/synchronization, and export or read-only endpoints were also found to lack ChallengeToken validation, but those paths cannot introduce arbitrary new configuration and export responses remain protected by the browser's same-origin policy, so no confidentiality impact has been demonstrated.
Cross-site request forgery in OTRS 7.0.X, 8.0.X, 2023.X through 2026.X before 2026.7.X lets an unauthenticated remote attacker induce a logged-in administrator to delete Import/Export templates through the AdminImportExport::TemplateDelete action, which fails to validate the ChallengeToken. The issue is moderate severity (CVSS 5.4, CWE-352) because exploitation requires an active administrator session and user interaction, yields no code execution or data disclosure, and matters only where the Import/Export template feature is in use; no public exploit has been identified at time of analysis.
Uncontrolled resource allocation in OTRS's e-mail handling subsystem allows a low-privileged authenticated user to trigger unbounded memory or resource consumption, ultimately aborting the webserver and causing a denial of service against the entire OTRS interface. Affected versions span OTRS 8.0.X through 2026.X prior to 2026.4.X, and the ((OTRS)) Community Edition 6.x and OTRS 7.x branches are noted by the vendor as very likely affected as well. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SVG content injection in OTRS ticket article rendering enables unauthenticated remote attackers to deliver browser-side denial of service against agents and customers who open affected tickets. Specially crafted SVG payloads submitted via inbound email trigger uncontrolled resource exhaustion during rendering, without requiring JavaScript execution, and the attack vector is not blocked by the application's configured Content Security Policy - making CSP-based mitigations ineffective. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, no-authentication-required delivery mechanism (via email) lowers the barrier to abuse significantly.
Authentication bypass in ((OTRS)) Community Edition 6.x and earlier lets an unauthenticated remote attacker impersonate any existing agent or customer account when HTTP Basic Authentication is the configured authentication backend. Because the CGI/mod_perl deployment maps an attacker-supplied 'Remote-User' request header into the HTTP_REMOTE_USER environment variable, OTRS treats that header value as an already-authenticated username and skips password verification, after which the Generic Interface can be accessed with the impersonated account's privileges. Exploitation is not unconditional: it requires Basic Auth to be the active backend, a CGI/mod_perl (not Mojolicious/Hypnotoad) deployment, and knowledge of a valid target username, which is why an independent assessment rates the attack complexity as High (AC:H) rather than the vendor's AC:L, and no public exploit code was identified at time of analysis. OTRS 7 and later are unaffected by this vector.
Path traversal in the OTRS SendSupportBundle functionality allows an authenticated administrator to delete files outside the intended directory, limited by the operating system permissions of the OTRS application process. The issue affects OTRS versions 7.0.X through 2026.X before 2026.7.X, as well as ((OTRS)) Community Edition 6.x and earlier; products based on Community Edition are likely affected. Despite a high CVSS score of 8.7, exploitation requires a valid administrative account and does not bypass OS file permissions, and no public exploit has been identified.
Unauthenticated SQL injection in OTRS and the legacy ((OTRS)) Community Edition database layer enables authentication bypass when the backing MySQL/MariaDB instance runs with the NO_BACKSLASH_ESCAPES SQL mode. The flaw carries a CVSS of 9.1 with network-reachable, no-privileges-required exploitation against confidentiality and integrity, but no public exploit identified at time of analysis and the issue is gated by a specific non-default database configuration.
Reflected cross-site scripting in OTRS 7.0.x and ((OTRS)) Community Edition 6.x and earlier allows remote attackers to execute arbitrary JavaScript in an authenticated agent's browser session by tricking the agent into clicking a crafted ticket-action URL. The CVSS 7.1 (UI:R) rating reflects the need for victim interaction, and no public exploit identified at time of analysis, but the high integrity impact and the ubiquity of OTRS-derived help-desk forks make this a meaningful risk for ticketing environments.
CSV export formula injection in OTRS (7.0.X, 8.0.X, and 2023.X through 2026.X before 2026.7.X, plus legacy ((OTRS)) Community Edition 6.x and products derived from it) lets attacker-influenced text that lands in ticket or contact fields be written into exported CSV files as spreadsheet formulas starting with =, +, -, or @, so that opening the export in Excel or similar software can cause unintended actions, information disclosure, or invocation of external functionality inside the spreadsheet client. Rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the issue is unauthenticated from the network perspective per the vector, since a payload can arrive through external channels such as inbound email routed into an OTRS queue rather than requiring a valid account; the real limiting factors are that an export workflow must actually be used and the recipient must generally confirm one or more spreadsheet security-warning dialogs before a formula executes. Only the victim's spreadsheet application is affected, no code executes on the OTRS server, and no public exploit identified at time of analysis with no CISA KEV listing.
Duplicate customer-identity records can be created in OTRS whenever more than one CustomerUser backend is configured (for example a database backend alongside LDAP), because the email-address uniqueness check is applied only within the backend selected at the time of creation rather than across all backends. An authenticated operator holding the permission to create or modify customer users (PR:L per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 5.4) can therefore register an address already assigned to a customer in another backend, after which ticket records or outgoing email may be associated with, or exposed to, the wrong customer identity. Exploitability is narrowed by two prerequisites - a non-default multi-backend CustomerUser configuration and a privileged customer-user management role - so this is a genuine but moderate-priority integrity and information-exposure issue rather than an urgent emergency; no public exploit identified at time of analysis and no CISA KEV listing.
Cross-site request forgery in OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and 2026.X before 2026.7.X lets an unauthenticated remote attacker cause an authenticated administrator's browser to fire the DBUpdateLogCleanUp administrative action through a forged GET request, deleting the DBUpdate log entries present at the time the request is processed and degrading diagnostic and audit history. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) exploitation requires an administrator with an active session to be lured into loading an attacker-controlled page, so the attacker cannot choose targets or confirm success, and no public exploit code was identified at time of analysis. Additional administrative, deployment/synchronization, and export or read-only endpoints were also found to lack ChallengeToken validation, but those paths cannot introduce arbitrary new configuration and export responses remain protected by the browser's same-origin policy, so no confidentiality impact has been demonstrated.
Cross-site request forgery in OTRS 7.0.X, 8.0.X, 2023.X through 2026.X before 2026.7.X lets an unauthenticated remote attacker induce a logged-in administrator to delete Import/Export templates through the AdminImportExport::TemplateDelete action, which fails to validate the ChallengeToken. The issue is moderate severity (CVSS 5.4, CWE-352) because exploitation requires an active administrator session and user interaction, yields no code execution or data disclosure, and matters only where the Import/Export template feature is in use; no public exploit has been identified at time of analysis.
Uncontrolled resource allocation in OTRS's e-mail handling subsystem allows a low-privileged authenticated user to trigger unbounded memory or resource consumption, ultimately aborting the webserver and causing a denial of service against the entire OTRS interface. Affected versions span OTRS 8.0.X through 2026.X prior to 2026.4.X, and the ((OTRS)) Community Edition 6.x and OTRS 7.x branches are noted by the vendor as very likely affected as well. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SVG content injection in OTRS ticket article rendering enables unauthenticated remote attackers to deliver browser-side denial of service against agents and customers who open affected tickets. Specially crafted SVG payloads submitted via inbound email trigger uncontrolled resource exhaustion during rendering, without requiring JavaScript execution, and the attack vector is not blocked by the application's configured Content Security Policy - making CSP-based mitigations ineffective. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, no-authentication-required delivery mechanism (via email) lowers the barrier to abuse significantly.