CVE-2008-7277: Otrs

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.

Affected products

• Otrs Otrs: up to and including 2.3.0; version 0.5 only; version 1.0 only; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; …

Published 2011-03-18. Last modified 2026-06-16.