Release Notes – OTOBO

OTOBO 11.0.16

Pia Cebic — Thu, 23 Apr 2026 09:32:52 +0000

SECURITY ADVISORY

OTOBO 11.0.16 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

April 23, 2026
Security Patch Release
MEDIUM
OTOBO 11.0

Security Fixes

[Security] Updated Compress::Raw::Zlib to address CVE-2026-3381 in Docker environments – The dependency Compress::Raw::Zlib has been updated to close a vulnerability that could affect Docker-based OTOBO installations. Non-Docker systems are generally not affected. [#5269]
[Security] Updated Mozilla::CA – The optional dependency Mozilla::CA, suggested as default configuration in several places, has been updated to the latest version to keep the certificate store current. [#5245]
[Security] CVE-2025-59490: Fixed XSS vulnerabilities – We closed cross-site scripting (XSS) vulnerabilities allowing attackers to execute malicious code in users’ browsers after those clicking on malicious links. All users are strongly advised to update to this version. [#5358, #5419]
[Security] CVE-2025-59393: Improved password masking in the Support Bundle generator – Passwords and sensitive credentials are now more reliably redacted when generating a support bundle, preventing accidental exposure of access data. [#5376]
[Security] Removed stack traces from frontend error messages – Stack traces are no longer exposed in frontend error messages, as they could reveal internal system information and potentially serve as an attack vector. [#5359]

Enhancements

[Enhancement] Improved output in the database update script for rel-11_0 – The database update script for rel-11_0 now provides more meaningful feedback during execution, making it significantly easier to diagnose issues and track update processes. [#5208]
[Enhancement] Support for connect attributes in non-primary databases – Connection attributes can now be configured for non-primary databases as well, enabling more flexible and granular control over database connections. (Users running multiple databases in OTOBO – e.g. a separate one for archive data – can now define individual connection settings such as timeouts or character sets for each of these databases.) [#5110]

Changes

[Change] Email X-headers as an external source for dynamic fields – Email X-headers are now recognized and processed as an external data source for dynamic fields. This facilitates to also set dynamic reference fields via email parsing. [#5164]

Bug Fixes

[Bugfix] Broken links to external icons and data leak – Broken links to external icons have been fixed and an associated data leak has been closed. [#5212]
[Bugfix] AgentTicketProcess and CustomerTicketProcess: hidden fields not displayed on initial page load – A bug has been fixed where hidden fields were not correctly shown when a process screen was loaded for the first time. [#5196]
[Bugfix] Leeway parameter was not passed when decoding JWT tokens – The leeway parameter is now correctly passed to JWT token decoding, resolving issues with time tolerance validation of tokens. [#5211]
[Bugfix] DF Ticket Reference: CustomerUserID is now correctly mapped to CustomerUserLogin for ticket search – When searching for tickets via dynamic fields with a ticket reference, the CustomerUserID was not correctly mapped to the CustomerUserLogin. This issue has been fixed. [#5300]
[Bugfix] DF CustomerUser Reference: external source attribute “Email” was not working – The “Email” attribute as an external source in dynamic fields of type CustomerUser Reference is now processed correctly. [#5273]
[Bugfix] DF CustomerUser Reference: implementation of FieldValueValidate – The FieldValueValidate function has been implemented for dynamic fields of type CustomerUser Reference to ensure correct value validation. [#5277]
[Bugfix] QueueDefault could prevent dynamic field values from being saved – A bug has been fixed where the use of QueueDefault prevented values in dynamic fields from being correctly persisted. [#4962]
[Bugfix] Queue set via URL did not correctly trigger ACLs in CustomerTicketMessage – When a queue was set via a URL parameter, associated ACLs were not reliably applied in the CustomerTicketMessage area. This issue has been fixed. [#5237]
[Bugfix] Quick date buttons were not working on the Responsible screen – The quick date buttons were non-functional on the screen for assigning responsible agents. This issue has been fixed. [#5221]
[Bugfix] ExternalURLJump: question marks and equals signs in configured links were not working – Special characters such as ? and = in ExternalURLJump links were not processed correctly. This issue has been fixed. [#5203]
[Bugfix] Fixed UI issues with labels in CustomerTicketProcess – Various display errors affecting labels in CustomerTicketProcess have been corrected. [#4985]
[Bugfix] Deleting dynamic field attachments was not possible in the customer interface – Removing attachments in dynamic fields was not functional in the customer interface. This issue has been fixed. [#5348]

Next steps

Update to OTOBO 11.0.16

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 11.0

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 10.1.17

Pia Cebic — Thu, 23 Apr 2026 09:30:59 +0000

SECURITY ADVISORY

OTOBO 10.1.17 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

April 23, 2026
Security Patch Release
MEDIUM
OTOBO 10.1

Security Fixes

[Security] Updated Compress::Raw::Zlib to address CVE-2026-3381 in Docker environments – The dependency Compress::Raw::Zlib has been updated to close a vulnerability that could affect Docker-based OTOBO installations. Non-Docker systems are generally not affected. [#5269 ]
[Security] Updated Mozilla::CA – The optional dependency Mozilla::CA, suggested as default configuration in several places, has been updated to the latest version to keep the certificate store current. [#5245]
[Security] CVE-2025-59490: Fixed XSS vulnerabilities – We closed cross-site scripting (XSS) vulnerabilities allowing attackers to execute malicious code in users’ browsers after those clicking on malicious links. All users are strongly advised to update to this version. [#5358, #5419]
[Security] CVE-2025-59393: Improved password masking in the Support Bundle generator – Passwords and sensitive credentials are now more reliably redacted when generating a support bundle, preventing accidental exposure of access data. [#5376 ]
[Security] Removed stack traces from frontend error messages – Stack traces are no longer exposed in frontend error messages, as they could reveal internal system information and potentially serve as an attack vector. [#5359 ]

Enhancements

[Enhancement] Display of Perl DBI database driver information in support data – Support data now includes detailed information about the Perl DBI database driver in use, making troubleshooting and the support process easier. [#5104]
[Enhancement] Added otobo-web/static URL for serving static files – Static files can now be served via the dedicated URL otobo-web/static, enabling a more flexible and performant web server configuration. [#5342]
[Enhancement] New console command Maint::Elasticsearch::TestConnection – The new console command allows the connection to Elasticsearch to be tested directly from the command line, simplifying administration and troubleshooting of Elasticsearch integrations. [#5340]

Bug Fixes

[Bugfix] Broken links to external icons and data leak – Broken links to external icons have been fixed and an associated data leak has been closed. [#5212]
[Bugfix] Queue set via URL did not correctly trigger ACLs in CustomerTicketMessage – When a queue was set via a URL parameter, associated ACLs were not reliably applied in the CustomerTicketMessage area. This issue has been fixed. [#5237]
[Bugfix] Agent name missing in system configuration setting history – The name of the person who made a change was not displayed in the change history of system configuration settings. This issue has been fixed. [#5071]
[Bugfix] Elasticsearch index tmpattachments was not managed by OTOBO – The Elasticsearch index tmpattachments was previously not managed by OTOBO, which could lead to inconsistencies. This has been corrected so that the index is now fully within OTOBO’s management scope. [#4326]

Next steps

Update to OTOBO 10.1.17

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.1 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 11.0.15

Pia Cebic — Wed, 04 Feb 2026 11:10:45 +0000

RELEASE NOTES

OTOBO 11.0.15 – Patch Level Release

RELEASE DATE:
RELEASE TYPE:
RELEASE:

February 4, 2026
OTOBO 11.0
Patch Level Release

Enhancements

[Enhancement] Advanced database configuration
Database connection attributes can be defined directly in the Config.pm. [#5054]

[Enhancement] More data in support data analysis
Additional database information in the Support Data Collector makes troubleshooting easier and speeds up analysis. [#5104, #5096]

Bug Fixes

[Bugfix] Correct display in the CKEditor: Highlighted text and links are displayed correctly again [#4958].
[Bugfix] More stable display of MultiValue Fields: ACL rules now apply reliably to dynamic fields with multiple values [#4790]. Multi-value fields hidden via ACL are also displayed correctly when some values are empty [#4843].
[Bugfix] Cleaned up ticket history for dynamic fields: Redundant history entries have been removed—for better clarity and traceability [#4988].

Next steps

Update to OTOBO 11.0.15

We recommend updating your system.

➞ Download Patch

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All changes

Security patch? System update?
You don’t have to handle it on your own.

For our support customers: Simply get in touch via the portal or give us a quick call—we’re here for you.

Not working with us yet? Maybe now is the perfect time.

Contact

OTOBO 11.0.14

Pia Cebic — Wed, 17 Dec 2025 11:24:19 +0000

RELEASE NOTES

OTOBO 11.0.14 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

December 17, 2025
Patch Level Release
OTOBO 11.0.14

Changes

[Changes] Improved default table styling in the RichText editor
Tables in the RichText editor now use an updated default styling. This improves readability and ensures a more consistent appearance, especially for documentation and structured ticket information. [#4800]
[Change] CKEditor 5 now generates HEX color styles instead of HSL for improved compatibility. [#4766]

Enhancements

[Enhancement] New transition action “TicketPrioritySet”
Ticket priorities can now be set automatically within processes. [#4896]
[Enhancement] Extended use of ticket reference fields
In the DynamicFieldSet transition action, ticket reference fields can now be used to define the TicketID. [#4818]
[Enhancement] Improved search accessibility
The Elasticsearch search box now supports an access key for faster and more convenient use. [#4810]

Bug Fixes

[Bugfix] Minor fixes in the High Contrast skin to improve accessibility. [#4899]
[Bugfix] Charts in reports now work correctly again in the default Docker environment. [#4890]
[Bugfix] Calendars are now fully configurable: administrators can manage all groups (new: LightAdmin functionality). [#4724]
[Bugfix] Dynamic fields with namespaces can again be used as filters in statistics. [#4844]
[Bugfix] Fixes for MultiValue set templates in the CustomerTicketProcess. [#4866]
[Bugfix] Fixed an issue where AJAX updates for set fields did not work in the CustomerTicketProcess. [#4868]
[Bugfix] More flexible CSS generation in the login area without a hardcoded default skin. [#4797]

Notes

Some dependencies have been updated. If ITSMConfigurationManagement is in use, it should also be updated in order to use the updated CodeMirror editor for editing ConfigItem definitions.

Next steps

Update to OTOBO 11.0.14

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 11.0.13

Pia Cebic — Thu, 23 Oct 2025 13:41:07 +0000

RELEASE NOTES

OTOBO 11.0.13 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 11.0.13

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

Alternative:
Instead of updating OTOBO, you can simply set OTOBO_IMAGE_REDIS=redis:8-bookworm in your .env file in the otobo-docker directory, then run: docker-compose down; docker-compose up -d to switch the Redis image.
Also, you can completely disable Redis by commenting out the line $Self->{'Cache::Module'} = [...] in your Kernel/Config.pm.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Enhancements

[Enhancement] Dynamic Lens fields are now also available for customer and customer user reference fields. [#4705]

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]
[Bugfix] Editing an article no longer triggers an unread icon in the toolbar. [#4688]
[Bugfix] Fixed a validation logic error for mandatory dynamic fields with regex checks. [#4751]
[Bugfix] Automatic linking of reference dynamic fields now works correctly with multiple values. [#4759]

Next steps

Update to OTOBO 11.0.13

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 10.1.16

Pia Cebic — Thu, 23 Oct 2025 13:40:51 +0000

RELEASE NOTES

OTOBO 10.1.16 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 10.1.16

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]

Next steps

Update to OTOBO 10.1.16

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 10.1.16 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 10.0.27

Pia Cebic — Thu, 23 Oct 2025 13:40:36 +0000

RELEASE NOTES

OTOBO 10.0.27 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 10.0.27

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]

Next steps

Update to OTOBO 10.0.27

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 10.0.27 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 11.0.12

Pia Cebic — Thu, 25 Sep 2025 09:59:45 +0000

SECURITY ADVISORY

OTOBO 11.0.12 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 11.0

Description

[Security | medium] Fix for a potential privilege escalation via backup.plA potential security vulnerability has been closed, which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. by modifying the sudoers file) – potentially enabled a command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

[Security | medium] Incorrect group assignment with LDAP-Sync and Nested Group Search
We fixed an issue where users were assigned too many groups when LDAP-Sync was used with the NestedGroupSearch option enabled in the Config.pm. The cause was a bug that always inherited nested groups to users already assigned to the parent group.
Only installations that authenticate agents via LDAP, use the LDAP-Sync module, and have NestedGroupSearch enabled are affected.
Standard systems without this configuration are not affected.
Thanks to our partner FREICON for reporting this! [#4695]

Enhancements

[Enhancement] More detailed database information in the Support Data Collector
The Support Data Collector now provides extended details about the database in use. This makes it easier to analyze system environments in support cases. [#4681]

Changes

[Changes] Adjusted linking for reference dynamic fields
The target pages of the reference dynamic fields for CustomerUser and CustomerCompany have been updated: instead of pointing to the administration pages, the links now lead directly to the corresponding Information Centers. [#4564]

Bug Fixes

[Bugfix] Customer ticket form: Fixed an issue where no tickets could be created if a DateTime field was hidden and past dates were not allowed. [#4238]
[Bugfix] Mobile view: Adjusted widths for CKEditor and attachment uploads in agent ticket masks. [#4238]
[Bugfix] Dynamic fields with grids: Fixed a bug that could cause an Internal Server Error in AgentTicketSearch and ticket overviews. [#4572]
[Bugfix] Webservices: Multiselect fields now work correctly. [#4668]
[Bugfix] TicketMenu in AgentTicketZoom: Fixed configuration of item order within a cluster. [#4444]
[Bugfix] System configuration: Saving a setting as a favorite works again. [#4130]
[Bugfix] TicketACL::Autoselect: Dynamic fields that were automatically selected are now properly hidden, even when part of a set or multivalue field. [#4485]
[Bugfix] Article table: If article creation fails midway, the table is now properly tidied up. [#4596]
[Bugfix] Reference fields: Standard link creation now also works for multivalue fields. [#4590]
[Bugfix] Translations: Services and SLAs are now translated correctly in more places. [#4580]
[Bugfix] Transition actions: Passing DynamicField_Name_Data now works as expected. [#4577]
[Bugfix] AgentTicketArticleEdit did not correctly enforce all article restrictions. (An agent who owned a ticket could, for example, wrongfully edit email articles.) [#4722]
[Bugfix] Validation of mandatory multi-value fields unified: Backend validation has been aligned with frontend validation. Previously, a mandatory field such as ['A','','C'] could be stored, as it was technically considered to “have a value” even if one index remained empty. [#4515]
[Bugfix] Display of code blocks in monospace: Code blocks were not displayed in monospace in HTML views of zoom masks and in CKEditor 5. [#4405]

Next steps

Update to OTOBO 11.0.12

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 11.0

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 10.1.15

Pia Cebic — Thu, 25 Sep 2025 09:56:50 +0000

SECURITY ADVISORY

OTOBO 10.1.15 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 10.1

Description

[Security | high] Fix for potential privilege escalation via backup.pl
We have closed a potential security vulnerability which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. through modifications in the sudoers file) – potentially enabled a command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

[Security | medium] Incorrect group assignment with LDAP-Sync and Nested Group Search
We fixed an issue where users were assigned too many groups when LDAP-Sync was used with the NestedGroupSearchoption enabled in the Config.pm. The cause was a bug that always inherited nested groups to users who were already assigned to the parent group.
Only installations that authenticate agents via LDAP, use the LDAP-Sync module, and have NestedGroupSearch enabled were affected.
Standard systems without this configuration are not affected.
Thanks to our partner FREICON for reporting this! [#4695]

Changes

[Change] Docker: Upgraded the Perl base image to 5.38-bookworm. [#4512]

Bug Fixes

[Bugfix] System Configuration: Fixed an issue where saving a setting as a favorite did not work. [#4130]
[Bugfix] AgentTicketActionCommon: Fixed a bug where the type update did not respect current parameters when saving. [#4359]
[Bugfix] Article handling: The article table is now properly tidied up if article creation fails midway. [#4596]
[Bugfix] OpenID Connect: Corrected login form behavior and improved misleading error messages shown after a browser restart. [#4393]
[Bugfix] DynamicField Webservice: Fixed a bug affecting the proper handling of DynamicField webservices. [#3446]

Next steps

Update to OTOBO 10.1.15

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.1 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 10.0.26

Pia Cebic — Thu, 25 Sep 2025 09:53:21 +0000

SECURITY ADVISORY

OTOBO 10.0.26 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 10.0

Security Fix

[Security | high] Fix for potential privilege escalation via backup.pl
We have closed a potential security vulnerability which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. through modifications in the sudoers file) – enabled command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

Changes

[Change] Docker: Upgraded Perl base image to 5.38-bookworm [#4619]

Bugfixes

[Bugfix] System Configuration: Fixed an issue where saving a setting as a favorite did not work. [#4130]
[Bugfix] AgentTicketActionCommon: Fixed an issue where the type update did not respect current parameters when saving. [#4359]

Next steps

Update to OTOBO 10.0.26

We recommend that you fix the vulnerability and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.0 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

🔔 Reminder: End of Support for OTOBO 10.0

We’d like to remind you that support for OTOBO 10.0 will end at the end of this year.

To ensure you continue working securely and efficiently, we recommend upgrading to the latest version. Our team will be happy to support you – from planning to implementation.

As always, feel free to reach out with any questions.

Contact

Release Notes – OTOBO

OTOBO 11.0.16

OTOBO 11.0.16 – Security Patch

Security Fixes

Enhancements

Changes

Bug Fixes

Next steps

Update to OTOBO 11.0.16

OTOBO 11.0

OTOBO 10.1.17

OTOBO 10.1.17 – Security Patch

Security Fixes

Enhancements

Bug Fixes

Next steps

Update to OTOBO 10.1.17

OTOBO 10.1 Change Log

Security patch? System update? No need to handle it alone.

OTOBO 11.0.15

OTOBO 11.0.15 – Patch Level Release

Enhancements

Bug Fixes

Next steps

Update to OTOBO 11.0.15

OTOBO 11.0 Change Log

Security patch? System update?You don’t have to handle it on your own.

OTOBO 11.0.14

OTOBO 11.0.14 – Patch Level Release

Changes

Enhancements

Bug Fixes

Notes

Next steps

Update to OTOBO 11.0.14

OTOBO 11.0 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 11.0.13

OTOBO 11.0.13 – Patch Level Release

Docker Maintenance

Enhancements

Bug Fixes

Next steps

Update to OTOBO 11.0.13

OTOBO 11.0 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 10.1.16

OTOBO 10.1.16 – Patch Level Release

Docker Maintenance

Bug Fixes

Next steps

Update to OTOBO 10.1.16

OTOBO 10.1.16 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 10.0.27

OTOBO 10.0.27 – Patch Level Release

Docker Maintenance

Bug Fixes

Next steps

Update to OTOBO 10.0.27

OTOBO 10.0.27 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 11.0.12

OTOBO 11.0.12 – Security Patch

Description

Enhancements

Changes

Bug Fixes

Next steps

Update to OTOBO 11.0.12

OTOBO 11.0

OTOBO 10.1.15

OTOBO 10.1.15 – Security Patch

Description

Changes

Bug Fixes

Next steps

Update to OTOBO 10.1.15

OTOBO 10.1 Change Log

Security patch? System update? No need to handle it alone.

Security patch? System update?
No need to handle it alone.

Security patch? System update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security patch? System update?
No need to handle it alone.