Medium severity5.3NVD Advisory· Published Jul 14, 2025· Updated Apr 15, 2026

CVE-2025-24391

Description

A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses.

This issue affects:

OTRS 7.0.X

OTRS 8.0.X
OTRS 2023.X
OTRS 2024.X
OTRS 2025.X

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

otrs.com/release-notes/otrs-security-advisory-2025-07/nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000