CVE-2024-43446

3.5 lowEPSS 0.2%

Low (3.5). EPSS 0.2% chance of exploitation in the next 30 days.

An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

Severity

CVSS 3.1

3.5 low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2025-01-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://otrs.com/release-notes/otrs-security-advisory-2025-02/

Check your stack JSON