Advisories · Technology

OTRS.

Every CVE that names OTRS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-93582 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Authentication bypass
Not analysed yet 12 Oct 2026
CVE-2026-93581 CVE record

CVSS 6.1 Medium

Insufficient Neutralization of Formula Elements in CSV Exports
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Other injection
Not analysed yet 12 Oct 2026
CVE-2026-78359 CVE record

CVSS 5.4 Medium

Duplicate Identity / Identity Shadowing across CustomerUser backends
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- CWE-694
- CWE-706
Not analysed yet 12 Oct 2026
CVE-2026-78358 CVE record

CVSS 4.3 Medium

Cross-Site Request Forgery in Administrative Actions
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Cross-site request forgery (CSRF)
Not analysed yet 12 Oct 2026
CVE-2026-78357 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Insufficient Session Revocation for JWT Authentication
- OTRS
- Authentication bypass
Not analysed yet 12 Oct 2026
CVE-2026-78356 CVE record

CVSS 5.3 Medium

Unauthenticated Disclosure of Agent Frontend Configuration
- OTRS
- Information disclosure
Not analysed yet 12 Oct 2026
CVE-2026-78355 CVE record

CVSS 8.7 High

Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Path traversal
Not analysed yet 12 Oct 2026
CVE-2026-48212 CVE record

CVSS 4.8 Medium

Stored XSS in external pages
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-48211 CVE record

CVSS 5.4 Medium

Cross-Site Request Forgery in Import/Export Admin console
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- Cross-site request forgery (CSRF)
Not analysed yet 12 Oct 2026
CVE-2026-48187 CVE record

CVSS 5.7 Medium

Email with special content can lead to DoS
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Denial of service
Not analysed yet 1 Jun 2026
CVE-2026-48188 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL Injection via MySQL Quote Method
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 1 Jun 2026
CVE-2026-48189 CVE record

CVSS 5.7 Medium

Bypass DedicatedAgentToCustomerGroups Setting
- OTRS
- Information disclosure
Not analysed yet 1 Jun 2026
CVE-2026-48190 CVE record

CVSS 3.5 Low

Incorrect handling of permissions in External Interface Config Item List module
- OTRS
- Broken access control
Not analysed yet 1 Jun 2026
CVE-2026-48191 CVE record

CVSS 3.5 Low

Wrong Permission Handling in Document Search Article Meta Filters
- OTRS
- Broken access control
Not analysed yet 1 Jun 2026
CVE-2026-48208 CVE record

CVSS 6.5 Medium

Denial-of-Service via SVG Rendering in Ticket
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Denial of service
- CWE-791
Not analysed yet 1 Jun 2026
CVE-2026-48209 CVE record

CVSS 7.1 High

Reflected XSS in authenticated agent context
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
- CWE-116
Not analysed yet 1 Jun 2026
CVE-2026-48210 CVE record

CVSS 5.7 Medium

Possible information disclosure via External Interface
- OTRS
- Information disclosure
- Privilege escalation
Not analysed yet 31 May 2026
CVE-2026-6060 CVE record

CVSS 4.5 Medium

Possible DoS via SQL Box
- OTRS
- Denial of service
Not analysed yet 20 Apr 2026
CVE-2025-24391 CVE record

CVSS 5.3 Medium

Possible user enumeration
- OTRS
- Information disclosure
Not analysed yet 14 Jul 2025
CVE-2025-24388 CVE record

CVSS 3.8 Low

Unsafe handling of AJAX calls
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-184
Not analysed yet 16 Jun 2025
CVE-2025-24387 CVE record

CVSS 4.8 Medium

Missing CSRF protection
- OTRS
- CWE-1275
Not analysed yet 10 Mar 2025
CVE-2025-24390 CVE record

CVSS 6.8 Medium

Missing Cookie Flags
- OTRS
- CWE-614
Not analysed yet 27 Jan 2025
CVE-2025-24389 CVE record

CVSS 6.3 Medium

SMTP Password will be shown in cleartext on some SMTP errors
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Information disclosure
Not analysed yet 27 Jan 2025
CVE-2024-43446 CVE record

CVSS 3.5 Low

Improper check of permissions in Generic Interface
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Privilege escalation
Not analysed yet 27 Jan 2025
CVE-2024-43445 CVE record

CVSS 5.4 Medium

Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 27 Jan 2025
CVE-2024-43444 CVE record

CVSS 8.2 High

Passwords are written to Admin Log Module
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Information disclosure
Not analysed yet 26 Aug 2024
CVE-2024-43443 CVE record

CVSS 4.9 Medium

Stored XSS in process management
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-790
Not analysed yet 26 Aug 2024
CVE-2024-43442 CVE record

CVSS 4.9 Medium

Stored XSS in System Configuration
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
- CWE-790
Not analysed yet 26 Aug 2024
CVE-2024-23794 CVE record

CVSS 5.2 Medium

Agents are able to lock the ticket without the "Owner" permission
- OTRS
- Privilege escalation
Not analysed yet 15 Jul 2024
CVE-2024-6540 CVE record

CVSS 5.7 Medium

Information exlosure in external interface
- OTRS
- CWE-790
Not analysed yet 15 Jul 2024
CVE-2024-23793 CVE record

CVSS 6.3 Medium

Upload of files outside application directory
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Path traversal
Not analysed yet 6 Jun 2024
CVE-2024-23790 CVE record

CVSS 3.5 Low

Missing file type check in avatar picture upload
- OTRS
- CWE-20
Not analysed yet 29 Jan 2024
CVE-2024-23791 CVE record

CVSS 4.9 Medium

Unnecessary data is written to log if issues during indexing occurs
- OTRS
- Information disclosure
Not analysed yet 29 Jan 2024
CVE-2024-23792 CVE record

CVSS 5.3 Medium

Insufficient access control
- OTRS
- Authentication bypass
Not analysed yet 29 Jan 2024
CVE-2023-6254 CVE record

CVSS 8.1 High

Password is send back to client
- OTRS
- Hard-coded credentials
Not analysed yet 27 Nov 2023
CVE-2023-5421 CVE record

CVSS 3.5 Low

Possible XSS execution in customer information
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 16 Oct 2023
CVE-2023-38059 CVE record

CVSS 5.3 Medium

External pictures can be loaded even if not allowed by configuration
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Information disclosure
Not analysed yet 16 Oct 2023
CVE-2023-5422 CVE record

CVSS 8.7 High

SSL Certificates are not checked for E-Mail Handling
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Weak cryptography or TLS
Not analysed yet 16 Oct 2023
CVE-2023-38060 CVE record

CVSS 6.3 Medium

Host header injection by attachments in web service
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 24 Jul 2023
CVE-2023-38058 CVE record

CVSS 4.1 Medium

Tickets can be moved without permissions
- OTRS
- Privilege escalation
Not analysed yet 24 Jul 2023
CVE-2023-38057 CVE record

CVSS 4.1 Medium

XSS stored in survey answers
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 24 Jul 2023
CVE-2023-38056 CVE record

CVSS 7.2 High

Code execution via System Configuration
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Command injection
Not analysed yet 24 Jul 2023
CVE-2023-2534 CVE record

CVSS 7.6 High

Information disclouse and DoS via websocket push events
- OTRS
- Broken access control
Not analysed yet 8 May 2023
CVE-2023-1250 CVE record

CVSS 7.4 High

Code execution through ACL creation
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 20 Mar 2023
CVE-2023-1248 CVE record

CVSS 6.1 Medium

Possible XSS in Ticket Actions
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
Not analysed yet 20 Mar 2023
CVE-2022-4427 CVE record

CVSS 6.5 Medium

SQL Injection via OTRS Search API
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 19 Dec 2022
CVE-2022-39052 CVE record

CVSS 7.5 High

DoS attack using email
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Denial of service
Not analysed yet 17 Oct 2022
CVE-2022-39051 CVE record

CVSS 6.8 Medium

Perl Code execution in Template Toolkit
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-913
Not analysed yet 5 Sept 2022
CVE-2022-39050 CVE record

CVSS 4.6 Medium

Possible XSS stored in customer information
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
Not analysed yet 5 Sept 2022
CVE-2022-39049 CVE record

CVSS 3.5 Low

Possible XSS in Admin Interface
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
Not analysed yet 5 Sept 2022
CVE-2022-32741 CVE record

CVSS 5.3 Medium

Information disclosure in Request New Password feature
- OTRS
- Information disclosure
Not analysed yet 13 Jun 2022
CVE-2022-32740 CVE record

CVSS 3.5 Low

Information disclosure in the External Interface
- OTRS
- Information disclosure
Not analysed yet 13 Jun 2022
CVE-2022-32739 CVE record

CVSS 3.5 Low

OTRS version number is always in the exported ICS files
- OTRS
- OTRS AG OTRSCalendarResourcePlanning
- Information disclosure
Not analysed yet 13 Jun 2022
CVE-2022-1004 CVE record

CVSS 4.3 Medium

Information disclosure in the External Interface
- OTRS
- Information disclosure
Not analysed yet 21 Mar 2022
CVE-2022-0475 CVE record

CVSS 3.5 Low

Possible XSS attack via translation
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 21 Mar 2022
CVE-2021-36100 CVE record

CVSS 6.4 Medium

Authenticated remote code execution
- OTRS
- OTRS AG SystemMonitoring
Not analysed yet 21 Mar 2022
CVE-2022-0473 CVE record

CVSS 3.8 Low

Dynamic field error message is vulnerable to XSS
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 7 Feb 2022
CVE-2021-36097 CVE record

CVSS 3.5 Low

Agents are able to lock the ticket without the "Owner" permission
- OTRS
- Privilege escalation
Not analysed yet 18 Oct 2021
CVE-2021-36096 CVE record

CVSS 5.2 Medium

Support Bundle includes S/Mime and PGP secret or PIN
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 6 Sept 2021
CVE-2021-36095 CVE record

CVSS 5.3 Medium

User enumeration issue using "lost password" feature
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 6 Sept 2021