CVE-2026-93582

The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...

CVE-2026-93582

The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior are vulnerable to an authentication bypass (CWE-290). The root cause is that the application accepts authenticated usernames from the REMOTE_USER or HTTP_REMOTE_USER environment variables. In CGI or mod_perl deployments, ...

CVE-2026-93582: Authentication Bypass by Spoofing

The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...

Znuny Generic Interface Data Compromise

The vulnerability of the Generic Interface component in the software application for rapid display and access to customer information in Znuny is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

EUVD-2025-14306

Malicious code in bioql PyPI...

CVE-2025-26846

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata...

CVE-2025-26846

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata...

DEBIAN-CVE-2025-26846

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata...

UBUNTU-CVE-2025-26846

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata...

CVE-2025-26846

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata...

CVE-2025-26846

Znuny versions prior to 7.1.4 are vulnerable to a missing authorization issue in the Generic Interface component. The software fails to properly check permissions when updating ticket metadata, which could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of ...

CVE-2025-26846: Missing Authorization

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata...

SUSE CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

SUSE CVE-2024-43446

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023.X OTRS 2024.X OTRS Community Edition: 6.0.x Products based on the OTRS Community Edition...

CVE-2024-43446 Improper check of permissions in Generic Interface

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023.X OTRS 2024.X OTRS Community Edition: 6.0.x Products based on the OTRS Community Edition...

CVE-2024-43446

CVE-2024-43446 affects OTRS: improper privilege management in the Generic Interface module allows users with read-only privileges to change ticket status. Impacted: OTRS 7.0.x, 8.0.x, 2023.x, 2024.x and ((OTRS)) Community Edition 6.0.x (and products built on it). Root cause: insufficient access c...

CVE-2024-43446 Improper check of permissions in Generic Interface

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023.X OTRS 2024.X OTRS Community Edition: 6.0.x Products based on the OTRS Community Edition...

CVE-2024-43446: Improper Privilege Management

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023.X OTRS 2024.X OTRS Community Edition: 6.0.x Products based on the OTRS Community Edition...

PT-2025-2648 · Otrs · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS versions 6.0.x through 8.0.x OTRS versions 2023.x through 2024.x Description: An improper privilege management issue in the OTRS Generic Interface module allows users with read-only permissions to change the ticket status. This issue may...

CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...