OTRS vulnerabilities

An improper input validation vulnerability in the database layer module of OTRS and ((OTRS)) Community Edition allows an unauthenticated SQL injection, which can lead to authentication bypass. This issue only affects systems where the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.

An improper neutralization of user-controllable input in OTRS and ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected XSS attacks via crafted request parameters. Malicious JavaScript can be executed in the context of an authenticated agent session when the crafted link is opened.

An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).

In STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules, incorrect permission handling allows gaining knowledge about the number of affected CIs, SLA, and services without gaining access to them.

In OTRS, the External Interface and ConfigItem List modules incorrectly handle permissions, allowing an authenticated customer to query the system for CI information. This affects only when CMDB is enabled and CustomerGroupSupport is used.

An improper input validation vulnerability in the OTRS Customer Backend module allows access to customer information restricted to other groups. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, but only when the CustomerGroupSupport feature is enabled.

An uncontrolled resource allocation vulnerability in OTRS email handling can lead to excessive resource consumption and webserver abortion. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, and likely also OTRS Community Edition 6.x and OTRS 7.x.

An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the 'Is visible for customer' flag and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket information to the External Frontend.