Release Notes &#8211; OTOBO

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All changes

Security patch? System update?
You don’t have to handle it on your own.

For our support customers: Simply get in touch via the portal or give us a quick call—we’re here for you.

Not working with us yet? Maybe now is the perfect time.

OTOBO 11.0.14

Pia Cebic — Wed, 17 Dec 2025 11:24:19 +0000

RELEASE NOTES

OTOBO 11.0.14 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

December 17, 2025
Patch Level Release
OTOBO 11.0.14

Changes

[Changes] Improved default table styling in the RichText editor
Tables in the RichText editor now use an updated default styling. This improves readability and ensures a more consistent appearance, especially for documentation and structured ticket information. [#4800]
[Change] CKEditor 5 now generates HEX color styles instead of HSL for improved compatibility. [#4766]

Enhancements

[Enhancement] New transition action “TicketPrioritySet”
Ticket priorities can now be set automatically within processes. [#4896]
[Enhancement] Extended use of ticket reference fields
In the DynamicFieldSet transition action, ticket reference fields can now be used to define the TicketID. [#4818]
[Enhancement] Improved search accessibility
The Elasticsearch search box now supports an access key for faster and more convenient use. [#4810]

Bug Fixes

[Bugfix] Minor fixes in the High Contrast skin to improve accessibility. [#4899]
[Bugfix] Charts in reports now work correctly again in the default Docker environment. [#4890]
[Bugfix] Calendars are now fully configurable: administrators can manage all groups (new: LightAdmin functionality). [#4724]
[Bugfix] Dynamic fields with namespaces can again be used as filters in statistics. [#4844]
[Bugfix] Fixes for MultiValue set templates in the CustomerTicketProcess. [#4866]
[Bugfix] Fixed an issue where AJAX updates for set fields did not work in the CustomerTicketProcess. [#4868]
[Bugfix] More flexible CSS generation in the login area without a hardcoded default skin. [#4797]

Notes

Some dependencies have been updated. If ITSMConfigurationManagement is in use, it should also be updated in order to use the updated CodeMirror editor for editing ConfigItem definitions.

Next steps

Update to OTOBO 11.0.14

We recommend updating your system to the latest version.

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

OTOBO 11.0.13

Pia Cebic — Thu, 23 Oct 2025 13:41:07 +0000

RELEASE NOTES

OTOBO 11.0.13 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 11.0.13

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

Alternative:
Instead of updating OTOBO, you can simply set OTOBO_IMAGE_REDIS=redis:8-bookworm in your .env file in the otobo-docker directory, then run: docker-compose down; docker-compose up -d to switch the Redis image.
Also, you can completely disable Redis by commenting out the line $Self->{'Cache::Module'} = [...] in your Kernel/Config.pm.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Enhancements

[Enhancement] Dynamic Lens fields are now also available for customer and customer user reference fields. [#4705]

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]
[Bugfix] Editing an article no longer triggers an unread icon in the toolbar. [#4688]
[Bugfix] Fixed a validation logic error for mandatory dynamic fields with regex checks. [#4751]
[Bugfix] Automatic linking of reference dynamic fields now works correctly with multiple values. [#4759]

Next steps

Update to OTOBO 11.0.13

We recommend updating your system to the latest version.

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

OTOBO 10.1.16

Pia Cebic — Thu, 23 Oct 2025 13:40:51 +0000

RELEASE NOTES

OTOBO 10.1.16 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 10.1.16

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]

Next steps

Update to OTOBO 10.1.16

We recommend updating your system to the latest version.

OTOBO 10.1.16 Change Log

A comprehensive overview of all current and past changes.

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

OTOBO 10.0.27

Pia Cebic — Thu, 23 Oct 2025 13:40:36 +0000

RELEASE NOTES

OTOBO 10.0.27 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 10.0.27

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]

Next steps

Update to OTOBO 10.0.27

We recommend updating your system to the latest version.

OTOBO 10.0.27 Change Log

A comprehensive overview of all current and past changes.

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

➞ Download Security Patch

OTOBO 11.0.12

Pia Cebic — Thu, 25 Sep 2025 09:59:45 +0000

SECURITY ADVISORY

OTOBO 11.0.12 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 11.0

Description

[Security | medium] Fix for a potential privilege escalation via backup.plA potential security vulnerability has been closed, which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. by modifying the sudoers file) – potentially enabled a command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

[Security | medium] Incorrect group assignment with LDAP-Sync and Nested Group Search
We fixed an issue where users were assigned too many groups when LDAP-Sync was used with the NestedGroupSearch option enabled in the Config.pm. The cause was a bug that always inherited nested groups to users already assigned to the parent group.
Only installations that authenticate agents via LDAP, use the LDAP-Sync module, and have NestedGroupSearch enabled are affected.
Standard systems without this configuration are not affected.
Thanks to our partner FREICON for reporting this! [#4695]

Enhancements

[Enhancement] More detailed database information in the Support Data Collector
The Support Data Collector now provides extended details about the database in use. This makes it easier to analyze system environments in support cases. [#4681]

Changes

[Changes] Adjusted linking for reference dynamic fields
The target pages of the reference dynamic fields for CustomerUser and CustomerCompany have been updated: instead of pointing to the administration pages, the links now lead directly to the corresponding Information Centers. [#4564]

Bug Fixes

[Bugfix] Customer ticket form: Fixed an issue where no tickets could be created if a DateTime field was hidden and past dates were not allowed. [#4238]
[Bugfix] Mobile view: Adjusted widths for CKEditor and attachment uploads in agent ticket masks. [#4238]
[Bugfix] Dynamic fields with grids: Fixed a bug that could cause an Internal Server Error in AgentTicketSearch and ticket overviews. [#4572]
[Bugfix] Webservices: Multiselect fields now work correctly. [#4668]
[Bugfix] TicketMenu in AgentTicketZoom: Fixed configuration of item order within a cluster. [#4444]
[Bugfix] System configuration: Saving a setting as a favorite works again. [#4130]
[Bugfix] TicketACL::Autoselect: Dynamic fields that were automatically selected are now properly hidden, even when part of a set or multivalue field. [#4485]
[Bugfix] Article table: If article creation fails midway, the table is now properly tidied up. [#4596]
[Bugfix] Reference fields: Standard link creation now also works for multivalue fields. [#4590]
[Bugfix] Translations: Services and SLAs are now translated correctly in more places. [#4580]
[Bugfix] Transition actions: Passing DynamicField_Name_Data now works as expected. [#4577]
[Bugfix] AgentTicketArticleEdit did not correctly enforce all article restrictions. (An agent who owned a ticket could, for example, wrongfully edit email articles.) [#4722]
[Bugfix] Validation of mandatory multi-value fields unified: Backend validation has been aligned with frontend validation. Previously, a mandatory field such as ['A','','C'] could be stored, as it was technically considered to “have a value” even if one index remained empty. [#4515]
[Bugfix] Display of code blocks in monospace: Code blocks were not displayed in monospace in HTML views of zoom masks and in CKEditor 5. [#4405]

Next steps

Update to OTOBO 11.0.12

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

OTOBO 11.0

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

➞ Download Security Patch

OTOBO 10.1.15

Pia Cebic — Thu, 25 Sep 2025 09:56:50 +0000

SECURITY ADVISORY

OTOBO 10.1.15 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 10.1

Description

[Security | high] Fix for potential privilege escalation via backup.pl
We have closed a potential security vulnerability which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. through modifications in the sudoers file) – potentially enabled a command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

[Security | medium] Incorrect group assignment with LDAP-Sync and Nested Group Search
We fixed an issue where users were assigned too many groups when LDAP-Sync was used with the NestedGroupSearchoption enabled in the Config.pm. The cause was a bug that always inherited nested groups to users who were already assigned to the parent group.
Only installations that authenticate agents via LDAP, use the LDAP-Sync module, and have NestedGroupSearch enabled were affected.
Standard systems without this configuration are not affected.
Thanks to our partner FREICON for reporting this! [#4695]

Changes

[Change] Docker: Upgraded the Perl base image to 5.38-bookworm. [#4512]

Bug Fixes

[Bugfix] System Configuration: Fixed an issue where saving a setting as a favorite did not work. [#4130]
[Bugfix] AgentTicketActionCommon: Fixed a bug where the type update did not respect current parameters when saving. [#4359]
[Bugfix] Article handling: The article table is now properly tidied up if article creation fails midway. [#4596]
[Bugfix] OpenID Connect: Corrected login form behavior and improved misleading error messages shown after a browser restart. [#4393]
[Bugfix] DynamicField Webservice: Fixed a bug affecting the proper handling of DynamicField webservices. [#3446]

Next steps

Update to OTOBO 10.1.15

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

OTOBO 10.1 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

➞ Download Security Patch

OTOBO 10.0.26

Pia Cebic — Thu, 25 Sep 2025 09:53:21 +0000

SECURITY ADVISORY

OTOBO 10.0.26 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 10.0

Security Fix

[Security | high] Fix for potential privilege escalation via backup.pl
We have closed a potential security vulnerability which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. through modifications in the sudoers file) – enabled command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

Changes

[Change] Docker: Upgraded Perl base image to 5.38-bookworm [#4619]

Bugfixes

[Bugfix] System Configuration: Fixed an issue where saving a setting as a favorite did not work. [#4130]
[Bugfix] AgentTicketActionCommon: Fixed an issue where the type update did not respect current parameters when saving. [#4359]

Next steps

Update to OTOBO 10.0.26

We recommend that you fix the vulnerability and benefit from the latest improvements. Please update your system.

OTOBO 10.0 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

🔔 Reminder: End of Support for OTOBO 10.0

We’d like to remind you that support for OTOBO 10.0 will end at the end of this year.

To ensure you continue working securely and efficiently, we recommend upgrading to the latest version. Our team will be happy to support you – from planning to implementation.

As always, feel free to reach out with any questions.

OTOBO 11.0.11

Pia Cebic — Thu, 31 Jul 2025 12:03:38 +0000

RELEASE NOTES

OTOBO 11.0.11 & Package Updates

PUBLIC:
RELEASE TYPE:
RELEASE:

July 25
OTOBO 11.0
Patch Level Release

Enhancements

Automatic Log Rotation by OTOBO:
The otobo.log file is now rotated directly by OTOBO – no external log management needed. This feature is enabled by default and uses a high maximum file size.
Tip: Adjust the parameters LogModule::LogFile::MaxSize and LogModule::LogFile::MaxKeepRotated to fit your requirements. [#3909]

Streamlined Login with OpenIDConnect:
On OTOBO systems exclusively integrated via OpenIDConnect, no unnecessary login form is shown any more after a login error. This ensures more clarity and less confusion for the user. [#4393]

Changes

Consistent Font in the Service Portal:
RichText content (e.g. the customer info tile) now uses the Quicksand font – just like the rest of the interface. [#4067]

Change in Handling of Default Values in Processes:
Default values of dynamic fields in the AgentTicketProcess module are now preserved, even when an ACL is applied. Previously, these values were mistakenly cleared by the ACL. [#4136]

HideShow no longer clears dynamic fields when hiding them:
This resolves inconsistencies with ACLs in editing masks. Field values are now preserved when fields are shown again. [#4360]

Bugfixes

[Bugfix] Web Service: Reference Fields Not Properly Validated
Validation (ValueValidate) in the TicketCreate web service operation did not reliably work for reference fields using ImportSearchAttribute. [#4214]
[Bugfix] Required Fields in MultiValue Sets Fixed
There were issues with required fields when using MultiValue sets – these have now been corrected. [#3820]
[Bugfix] Tooltip Icon Was Not Hidden Correctly
When TicketACL::Autoselect was active, the tooltip icon remained visible. This behavior has now been fixed. [#4434]
[Bugfix] Form Values Lost After Change of Ticket Type
When saving via AgentTicketActionCommon, some form parameters were not preserved if the ticket type was changed. This issue has been resolved. [#4359]
[Bugfix] HideShow now correctly respects default values in AgentTicketProcess. [#4136]
[Bugfix] External source transformation now works for MultiValue fields within a set. [#4424]
[Bugfix] Dynamic field names in the ticket history no longer include process activity IDs for customer activities. [#4532]
[Bugfix] Buttons in the Rich Text Editor (CKEditor5) are now translatable and adapt to the selected language. [#4245]
[Bugfix] DynamicField_Date now works reliably for all entries in a MultiValue set. [#3930]
…and much more!

Package Updates

New Package Versions Released Alongside the OTOBO Update

Updates for the following packages were released together with the OTOBO update:
ServiceCatalog (11.0.4), ITSMCore (11.0.6), and ITSMIncidentProblemManagement (11.0.2).

The ServiceCatalog has been extensively revised (more information).

The most important change is the way ticket data is processed internally.

ServiceCatalog and IncidentProblemManagement can now be installed in parallel.

Important for the update process:
Pay attention to the order of updates: If you are using ITSMIncidentProblemManagement, update to version 11.0.3 first – then update ITSMCore to 11.0.6.

Next steps

Update to OTOBO 11.0.11

On systems that are not affected, you can safely skip this patch.

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

System Update?

You’re not on your own.

Already working with us?
Just get in touch via our portal or give us a call – we’ll take care of it.

Haven’t worked with us yet?
Maybe now’s the perfect time. We’re happy to support you with your next update.
Just reach out – we’d love to hear from you!