Advisories · Technology

OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition.

Every CVE that names OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-93582 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Authentication bypass
Not analysed yet 12 Oct 2026
CVE-2026-93581 CVE record

CVSS 6.1 Medium

Insufficient Neutralization of Formula Elements in CSV Exports
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Other injection
Not analysed yet 12 Oct 2026
CVE-2026-78359 CVE record

CVSS 5.4 Medium

Duplicate Identity / Identity Shadowing across CustomerUser backends
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- CWE-694
- CWE-706
Not analysed yet 12 Oct 2026
CVE-2026-78358 CVE record

CVSS 4.3 Medium

Cross-Site Request Forgery in Administrative Actions
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Cross-site request forgery (CSRF)
Not analysed yet 12 Oct 2026
CVE-2026-78355 CVE record

CVSS 8.7 High

Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Path traversal
Not analysed yet 12 Oct 2026
CVE-2026-48211 CVE record

CVSS 5.4 Medium

Cross-Site Request Forgery in Import/Export Admin console
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Cross-site request forgery (CSRF)
Not analysed yet 12 Oct 2026