EUVD-2026-97269

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend...

CVE-2026-78359

OTRS versions 7.0.X , 8.0.X , 2023.X , 2024.X , 2025.X , and 2026.X before 2026.7.X , as well as Community Edition 6.x and before , are vulnerable to Identity Shadowing . The root cause is that OTRS fails to enforce unique customer user email addresses across multiple configured backends (e.g., a...