CVE-2021-36097

—

CVSS 3.1

4.3 medium

EPSS

<1%p43

Published

Oct 18, 2021 (Oct 18, 2021)

Modified

Jun 17, 2026

Description

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

Vendors: otrs
Products: otrs
Weakness: CWE-266
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.