security@otrs.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@otrs.com
03
assessed vulnerabilities (91)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-93582US | — | — | ||
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variab… | ||||
| CVE-2026-93581US | — | — | ||
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or receive… | ||||
| CVE-2026-78359US | — | — | ||
OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP,… | ||||
| CVE-2026-78358US | — | — | ||
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action ca… | ||||
| CVE-2026-78357US | — | — | ||
Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an exist… | ||||
| CVE-2026-78356US | — | — | ||
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that… | ||||
| CVE-2026-78355US | — | — | ||
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.
This may a… | ||||
| CVE-2026-48212US | — | — | ||
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users a… | ||||
| CVE-2026-48211US | — | — | ||
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::Templ… | ||||
| CVE-2026-48209US | — | — | ||
An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting… | ||||
| CVE-2026-48208US | — | Exploit | ||
An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email… | ||||
| CVE-2026-48191US | —OT elevated | — | ||
An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of a… | ||||
| CVE-2026-48190US | —OT elevated | — | ||
An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note… | ||||
| CVE-2026-48189US | — | — | ||
An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature… | ||||
| CVE-2026-48188US | — | Exploit | ||
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication b… | ||||
| CVE-2026-48187US | — | — | ||
An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This… | ||||
| CVE-2026-48210US | — | — | ||
An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disablin… | ||||
| CVE-2026-6060US | — | Exploit | ||
A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis… | ||||
| CVE-2025-24391US | — | — | ||
A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enabl… | ||||
| CVE-2025-24388US | — | — | ||
A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin user.
This issue aff… | ||||