https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:04:01.737108+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-23794 CVE-2024-23794 — Agents are able to lock the ticket without the "Owner" permission 2026-10-05T21:04:03.598944+00:00

Affected: OTRS AG OTRS

An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS:

* 8.0.X * 2023.X * from 2024.X through 2024.4.x