OTRS Improper Privilege Management Vulnerability in Generic Interface Module

A vulnerability allowing improper privilege management has been identified in the OTRS Generic Interface module. This issue allows users with read-only permissions to change the status of tickets. The vulnerability affects multiple OTRS versions, including 7.0.X, 8.0.X, 2023.X, 2024.X, and the Community Edition 6.0.x. Additionally, products based on the OTRS Community Edition are likely affected.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in ticket status, allowing users to manipulate workflow and potentially disrupt service management processes.

Remediation

Users are advised to update to OTRS version 2025.1.x. Note that there will be no patches for OTRS 7.