CVE-2021-21438: Otrs Faq

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions.

Affected products

• Otrs Faq: from 6.0.0, before 6.0.29 (fixed in 6.0.29)
• Otrs Otrs: from 7.0.0, before 7.0.24 (fixed in 7.0.24)

Published 2021-03-22. Last modified 2026-06-17.