SECURITY ADVISORY

OTOBO 11.0.18 – Security Patch

PUBLICATION DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSIONS:

16 September 2026
Security Patch Release
HIGH
OTOBO 11

Security Fixes

[Security Fix – high criticality] In very specific scenarios, it was possible to gain access to privileges or third-party sessions in OTOBO environments using the “HTTP Basic Auth” authentication backend. [#6128]

Details on which systems are affected and recommendations for action to be found here.

[Security] Preventing the listing of queue names in ‘AgentTicketQueue’. [#6092]
[Security] Update of moment.js JavaScript library from 2.29.3 touf 2.30.1. [#6061]
[Security] VirtualFS Write: Fix for the previously inadequate `Content` check. [#5572]

Enhancements

[Enhancement] New implementation of the detect attachment postmaster filter. [#3422]
[Enhancement] Nested LDAP Sync: Use complete information from ‘memberurl’ attribute. [#4696]

Bugfixes

[Bugfix] Correction to the calculation of the total time for an article when it is edited multiple times. [#3592]
[Bugfix] Revision of the display of DynamicField Richtext in the Process Activity Dialog. [#3720]
[Bugfix] Login button was not acessible via tab key. [#5351]
[Bugfix] Correctly populating $Param{Queue} in AgentDynamicFieldDBSearch.pm and CustomerDynamicFieldDBSearch.pm. [#5552]
[Bugfix] DynamicField Database: Corrected removing the last existing entry in a MultiValue element when clicking the minus button. [#5932]
[Bugfix] Improved ExternalSourceTransform. [#5942]
[Bugfix] Corrected parsing of data regarding installed packages. [#5947]
[Bugfix] Corrected storing of Customer Certificates. [#5952]
[Bugfix] S/MIME messages in CMS format are decrypted correctly again. [#5998] – in progress
[Bugfix] AdminDynamicFieldLens: Corrected ConfigItem field type names in whitelist. [#6025]
[Bugfix] ACLs workproperly on Set-inner fields in a Lens to a Set. [#6086]
[Bugfix] DF Labels for Dynamic Fields in dynamic fields inside a DynamicField-Set can be translated, now. [#6099]
[Bugfix] Corrected the display of values for a Lens with a Set Field as an attribute (e.g., in the ticket history). [#6104]

Next Steps

Update to OTOBO 11.0.18

We strongly recommend updating the system as soon as possible.

➞ Download Security Patch

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All changes

Need support?

We’re happy to help. Just get in touch.