Release Notes – OTOBO

OTOBO 11.1 Beta

Pia Cebic — Wed, 24 Jun 2026 13:52:14 +0000

RELEASE NOTES

OTOBO 11.1 (Beta)

More Power for Your Service Management

RELEASE DATE:
RELEASE TYPE:
RELEASE:

24 June 2026
Beta Release
11.1 (Beta)

OTOBO 11.1 is packed with quality-of-life improvements and delivers real value in modeling, integration & system connectivity, and administration.

What’s new in OTOBO 11.1 (Beta)

HIGHLIGHT 1

Ticket Handling – Better Overview, Faster Results

Fewer clicks, more context, faster decisions. And this is just the beginning. With version 11.1, working within the ticket – where agents spend the majority of their day – is now faster and more intuitive.

Elasticsearch – Search at a New Level
Additional dialogues, field-based queries, and an extended syntax – for example Title:Test* AND Body:Test* or Boolean operators with AND / NOT – make the fast, concurrent search more precise. Anyone using Elasticsearch will notice the difference immediately.

Similar Tickets – Always in Sight
Powered by Elasticsearch, the new ‘Similar Tickets’ widget displays related tickets directly in the Ticket Zoom view. This eliminates the need for manual searches, as similar tickets are shown automatically. It is one of the tasks soon to be handled by the OTOBO AI, Roboto.

Full Control Over the Ticket History
Article editing, including time tracking, is now a standard feature – no separate package required. Ticket articles can be edited, deleted, or pinned directly within the Ticket Zoom view. Easily correct mistakes, remove clutter, and keep key information in sight to ensure your ticket history stays clear and organized.

Filters That Work for You
In ticket lists, multiple filters can now be set parallely. Configure them once, enjoy the perfect view permanently. No more manual re-filtering, no more searching through long lists. The right view is always just one click away.

HIGHLIGHT 2

Process Management – Model with Precision, Control with Confidence

With 11.1, process management in OTOBO evolves significantly – in maturity, flexibility, and the depth to which processes can be modeled. Anyone building and maintaining complex processes will notice the difference immediately.

Structure Processes, Maintain a Clear Overview
As complex process setups grow, they can quickly become cluttered. Namespaces logically group process elements, ensuring admins keep a clear overview even within highly intricate workflows.
Global or Process-Specific – You Decide
Process elements can now be marked as either global or process-specific. A simple checkbox determines whether an element should be available across all processes – or restricted to a specific one.
Logical Transitions
Transitions now support Not, Any, and All logic – including checks for empty fields. Dynamic fields within a set can be addressed directly via Field1::Field2. The result: process logic that fits reality – not the other way around.

Templates That Work Everywhere
The ticket templates you know and love can now also be used in process dialogs. Using templates ensures that content is captured cleanly from the very start.
Customers See What They Need
Process and activity details can now be hidden within the customer interface. Customers see exactly what they need – and nothing that distracts them. The result: fewer inquiries, fewer misunderstandings, reduced support overhead.
Less Searching, More Control
Anyone managing large numbers of processes knows the pain point: searching takes up valuable time. Improved sorting for process elements in the admin area completely eliminates this issue – making elements faster to find and keeping management straightforward, even as complexity grows.

HIGHLIGHT 3

Dynamic Fields – Information Precisely Where Needed

In OTOBO, we call them “Dynamic Fields” – but they are so much more. These fields only display when and just where they are needed. Provide information on linked objects directly within the ticket. Build forms that seamlessly adapt to the context. With 11.1, Dynamic Fields turn even more powerful.

Only What’s Relevant – At the Right Moment
Dynamic Fields of the “Reference” type link FAQ articles, services, customers, customer users, or ConfigItems directly to a ticket, or to each other. Lenses provide instant insight into the details of these linked elements – without ever needing to open the object itself. Fewer clicks, no context switching – all relevant information precisely where it’s needed. The result: reduced handling time per ticket and more time for customers.

HIGHLIGHT 4

Security – Modern Authentication, Secure Connectivity

With 11.1, OTOBO takes security and authentication to the next level. Modern standards, centralized management, and encrypted connectivity – no workarounds, no third-party packages.

Manage Tokens Centrally – OAuth Token Management
OTOBO now features a dedicated token management system. Tokens enable secure authentication with external services – covering email connectivity via POP, IMAP – now also SMTP –, as well as outgoing web services. No more expired passwords, no searching through scattered configurations, and zero administrative overhead when passwords change. Everything is centralized – everything is under control.
One Login for Everything – OpenID Connect
Logging into OTOBO via OpenID Connect enables Single Sign-On (SSO) for both agents and customers. No separate OTOBO passwords required – instead, it offers a seamless integration into your existing corporate authentication. One login, all systems, no password chaos.

Encrypted Database Connectivity
The DB backend transitions from DBD::mysql to DBD::MariaDB – actively maintained, more modern, and optimized for current database versions. Encrypted connectivity for both MySQL and MariaDB is now available, with authentication plugins selectable directly within the installer. Sensitive data remains secure – without the need for manual workarounds.
OTOBO and OTOBO Docker – Now Independent
Starting with 11.1, OTOBO and OTOBO Docker feature independent release cycles. Updates can be applied completely separate from one another – eliminating dependencies between the two. Expect clearer version details in example files, greater maintenance flexibility, and continuously updated ‘latest’ images.

HIGHLIGHT 5

Data Exchange and Integration – Significantly Simplified

OTOBO 11.1 simplifies data exchange – both incoming and outgoing. It brings enhanced compatibility with external systems and full control over configurations and objects. All included as standard, with no extra packages required.

Web Services That Adapt
Attachments can now be transferred via multipart/form-data – a prerequisite for direct integration with JIRA, OpenProject, and other systems that require this specific format. For outgoing data, you can now enforce specific formats such as arrays to ensure the interface receives exactly what it expects. Additionally, OAuth is now available as a supported authentication method for outgoing web services.

Export Configurations – And Reuse Them
Entire configuration packages – including processes, Dynamic Fields, notifications, queues, and ACLs – can now be exported to .csv files and imported back into the system. This can be done directly within the respective settings screen – no detours, no manual rebuilding.
Export Objects – Migration Made Easy

Moving forward, tickets, customers, customer users, and ConfigItems can be seamlessly transferred directly under Admin → Import/Export. Whether for a migration or straightforward data exchange – starting with 11.1, both are available out of the box in the OTOBO standard.

Technical Notes

⚠️ The update process will create a new folder structure – any manual customisations must be packaged in advance or reapplied afterwards.

⚠️ The MailAccountOAuth2 package has been integrated into the standard – manual adjustments are required during the upgrade.

Changes

[Change] Caching in the file system instead of Redis Cache for Docker based installations [#5728]
[Change] Improved file handling for OTOBO updates [#5077]
[Change] Replacement of the MailaccountOAuth2 package – see warning above! [#5652]
[Change] Reworked article actions sysconfig structure [#5126]
[Change] Support for SessionUseCookie = 0 removed [#4426]

Enhancements

[Enhancement] OIDC/Oauth2 authentication for web services [#4450]
[Enhancement] Process Management: Global vs. local scoping and namespaces for process elements [#5589]
[Enhancement] Process transition validation now supports additional array operators and make them work with DynamicField Sets. [#5590]
[Enhancement] Ticket lists support multiple filters now [#1831]
[Enhancement] Integrated Elasticsearch-Extension package into the core [#5350]
[Enhancement] New: Elasticsearch Similar Tickets Widget [#5508]
[Enhancement] Integrated ProcessTicketTemplates package into the core – use ticket templates in process dialogues, too [#5436]
[Enhancement] Integrated CustomerTicketSearch package into the core – full-text search in the customer interface [#5161]
[Enhancement] Integrate package ExtendedArticleEdit into core – edit the text of external articles (not for emails), article dynamic fields, and further attributes as well as their visibility [#4258]
[Enhancement] Include Package CK5-FullWindowMode into core – maximise the editor mask [#5415]
[Enhancement] New: Checklists in CK5 Editor [#5415]
[Enhancement] Include Package TicketUpdateOperationExternalIdentifier into core – supporting external identifiers in automatic ticket updates via external systems [#5413]
[Enhancement] Include package ImportExportStandardObjects into core – easy import/export for standard objects [#5148]
[Enhancement] Include package ImportExportCustomerCompany into core – easy import/export for customer companies [#5005]
[Enhancement] Include package PostMasterXFromHeader into core – set the customer user automatically based on information within the email body [#5008]
[Enhancement] Show/Hide Inner Set Fields – ACLs supported for Dynamic Fields within Sets now, too [#5524]
[Enhancement] Enable HideShow for AgentTicketCompose – ACLs supported in the Reply mask in the agent interface [#3537]
[Enhancement] Customer interface: Ticket age switches to create time in ticket lists automatically after a configurable amount of time (default 24h) [#1826]
[Enhancement] Selection of DB authentication plugin in the installer is supported [#5102]
[Enhancement] Ticket templates support defining the next ticket state now [#5542]
[Enhancement] Lens Fields can point directly to Reference Fields now, too [#3186]
[Enhancement] Lens Fields can point directly to Sets now [#4910]
[Enhancement] You can set the exact datatype for web services in XSLT now (Boolean, array) [#5507]
[Enhancement] Web services support multipart/formadata as well now (attachments!) [#5444]
[Enhancement] Added validity state for PostMaster Filters [#4200]
[Enhancement] Added a StopAfterMatch indicator in AdminPostMasterFilter Overview [#1618]
[Enhancement] Customer interface: Dynamic fields for the Reply Dialogue can be added in DynamicFieldScreens now [#4355]

🤍 Thank you to the community and all contributors!
Now it’s time to: test the Beta, share your feedback – so the stable release can follow soon.

Next steps

Update to OTOBO 11.1

We recommend updating your system.

➞ Download

OTOBO 11.1 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Update, Upgrade, or Questions?
We’re here.

Support customers can simply get in touch via the portal or give us a quick call. No support contract yet? Perhaps now is the right time.

Kontakt

OTOBO 11.0.16

Pia Cebic — Thu, 23 Apr 2026 09:32:52 +0000

SECURITY ADVISORY

OTOBO 11.0.16 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

April 23, 2026
Security Patch Release
MEDIUM
OTOBO 11.0

Security Fixes

[Security] Updated Compress::Raw::Zlib to address CVE-2026-3381 in Docker environments – The dependency Compress::Raw::Zlib has been updated to close a vulnerability that could affect Docker-based OTOBO installations. Non-Docker systems are generally not affected. [#5269]
[Security] Updated Mozilla::CA – The optional dependency Mozilla::CA, suggested as default configuration in several places, has been updated to the latest version to keep the certificate store current. [#5245]
[Security] CVE-2025-59490: Fixed XSS vulnerabilities – We closed cross-site scripting (XSS) vulnerabilities allowing attackers to execute malicious code in users’ browsers after those clicking on malicious links. All users are strongly advised to update to this version. [#5358, #5419]
[Security] CVE-2025-59393: Improved password masking in the Support Bundle generator – Passwords and sensitive credentials are now more reliably redacted when generating a support bundle, preventing accidental exposure of access data. [#5376]
[Security] Removed stack traces from frontend error messages – Stack traces are no longer exposed in frontend error messages, as they could reveal internal system information and potentially serve as an attack vector. [#5359]

Enhancements

[Enhancement] Improved output in the database update script for rel-11_0 – The database update script for rel-11_0 now provides more meaningful feedback during execution, making it significantly easier to diagnose issues and track update processes. [#5208]
[Enhancement] Support for connect attributes in non-primary databases – Connection attributes can now be configured for non-primary databases as well, enabling more flexible and granular control over database connections. (Users running multiple databases in OTOBO – e.g. a separate one for archive data – can now define individual connection settings such as timeouts or character sets for each of these databases.) [#5110]

Changes

[Change] Email X-headers as an external source for dynamic fields – Email X-headers are now recognized and processed as an external data source for dynamic fields. This facilitates to also set dynamic reference fields via email parsing. [#5164]

Bug Fixes

[Bugfix] Broken links to external icons and data leak – Broken links to external icons have been fixed and an associated data leak has been closed. [#5212]
[Bugfix] AgentTicketProcess and CustomerTicketProcess: hidden fields not displayed on initial page load – A bug has been fixed where hidden fields were not correctly shown when a process screen was loaded for the first time. [#5196]
[Bugfix] Leeway parameter was not passed when decoding JWT tokens – The leeway parameter is now correctly passed to JWT token decoding, resolving issues with time tolerance validation of tokens. [#5211]
[Bugfix] DF Ticket Reference: CustomerUserID is now correctly mapped to CustomerUserLogin for ticket search – When searching for tickets via dynamic fields with a ticket reference, the CustomerUserID was not correctly mapped to the CustomerUserLogin. This issue has been fixed. [#5300]
[Bugfix] DF CustomerUser Reference: external source attribute “Email” was not working – The “Email” attribute as an external source in dynamic fields of type CustomerUser Reference is now processed correctly. [#5273]
[Bugfix] DF CustomerUser Reference: implementation of FieldValueValidate – The FieldValueValidate function has been implemented for dynamic fields of type CustomerUser Reference to ensure correct value validation. [#5277]
[Bugfix] QueueDefault could prevent dynamic field values from being saved – A bug has been fixed where the use of QueueDefault prevented values in dynamic fields from being correctly persisted. [#4962]
[Bugfix] Queue set via URL did not correctly trigger ACLs in CustomerTicketMessage – When a queue was set via a URL parameter, associated ACLs were not reliably applied in the CustomerTicketMessage area. This issue has been fixed. [#5237]
[Bugfix] Quick date buttons were not working on the Responsible screen – The quick date buttons were non-functional on the screen for assigning responsible agents. This issue has been fixed. [#5221]
[Bugfix] ExternalURLJump: question marks and equals signs in configured links were not working – Special characters such as ? and = in ExternalURLJump links were not processed correctly. This issue has been fixed. [#5203]
[Bugfix] Fixed UI issues with labels in CustomerTicketProcess – Various display errors affecting labels in CustomerTicketProcess have been corrected. [#4985]
[Bugfix] Deleting dynamic field attachments was not possible in the customer interface – Removing attachments in dynamic fields was not functional in the customer interface. This issue has been fixed. [#5348]

Next steps

Update to OTOBO 11.0.16

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 11.0

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 10.1.17

Pia Cebic — Thu, 23 Apr 2026 09:30:59 +0000

SECURITY ADVISORY

OTOBO 10.1.17 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

April 23, 2026
Security Patch Release
MEDIUM
OTOBO 10.1

Security Fixes

[Security] Updated Compress::Raw::Zlib to address CVE-2026-3381 in Docker environments – The dependency Compress::Raw::Zlib has been updated to close a vulnerability that could affect Docker-based OTOBO installations. Non-Docker systems are generally not affected. [#5269 ]
[Security] Updated Mozilla::CA – The optional dependency Mozilla::CA, suggested as default configuration in several places, has been updated to the latest version to keep the certificate store current. [#5245]
[Security] CVE-2025-59490: Fixed XSS vulnerabilities – We closed cross-site scripting (XSS) vulnerabilities allowing attackers to execute malicious code in users’ browsers after those clicking on malicious links. All users are strongly advised to update to this version. [#5358, #5419]
[Security] CVE-2025-59393: Improved password masking in the Support Bundle generator – Passwords and sensitive credentials are now more reliably redacted when generating a support bundle, preventing accidental exposure of access data. [#5376 ]
[Security] Removed stack traces from frontend error messages – Stack traces are no longer exposed in frontend error messages, as they could reveal internal system information and potentially serve as an attack vector. [#5359 ]

Enhancements

[Enhancement] Display of Perl DBI database driver information in support data – Support data now includes detailed information about the Perl DBI database driver in use, making troubleshooting and the support process easier. [#5104]
[Enhancement] Added otobo-web/static URL for serving static files – Static files can now be served via the dedicated URL otobo-web/static, enabling a more flexible and performant web server configuration. [#5342]
[Enhancement] New console command Maint::Elasticsearch::TestConnection – The new console command allows the connection to Elasticsearch to be tested directly from the command line, simplifying administration and troubleshooting of Elasticsearch integrations. [#5340]

Bug Fixes

[Bugfix] Broken links to external icons and data leak – Broken links to external icons have been fixed and an associated data leak has been closed. [#5212]
[Bugfix] Queue set via URL did not correctly trigger ACLs in CustomerTicketMessage – When a queue was set via a URL parameter, associated ACLs were not reliably applied in the CustomerTicketMessage area. This issue has been fixed. [#5237]
[Bugfix] Agent name missing in system configuration setting history – The name of the person who made a change was not displayed in the change history of system configuration settings. This issue has been fixed. [#5071]
[Bugfix] Elasticsearch index tmpattachments was not managed by OTOBO – The Elasticsearch index tmpattachments was previously not managed by OTOBO, which could lead to inconsistencies. This has been corrected so that the index is now fully within OTOBO’s management scope. [#4326]

Next steps

Update to OTOBO 10.1.17

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.1 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 11.0.15

Pia Cebic — Wed, 04 Feb 2026 11:10:45 +0000

RELEASE NOTES

OTOBO 11.0.15 – Patch Level Release

RELEASE DATE:
RELEASE TYPE:
RELEASE:

February 4, 2026
OTOBO 11.0
Patch Level Release

Enhancements

[Enhancement] Advanced database configuration
Database connection attributes can be defined directly in the Config.pm. [#5054]

[Enhancement] More data in support data analysis
Additional database information in the Support Data Collector makes troubleshooting easier and speeds up analysis. [#5104, #5096]

Bug Fixes

[Bugfix] Correct display in the CKEditor: Highlighted text and links are displayed correctly again [#4958].
[Bugfix] More stable display of MultiValue Fields: ACL rules now apply reliably to dynamic fields with multiple values [#4790]. Multi-value fields hidden via ACL are also displayed correctly when some values are empty [#4843].
[Bugfix] Cleaned up ticket history for dynamic fields: Redundant history entries have been removed—for better clarity and traceability [#4988].

Next steps

Update to OTOBO 11.0.15

We recommend updating your system.

➞ Download Patch

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All changes

Security patch? System update?
You don’t have to handle it on your own.

For our support customers: Simply get in touch via the portal or give us a quick call—we’re here for you.

Not working with us yet? Maybe now is the perfect time.

Contact

OTOBO 11.0.14

Pia Cebic — Wed, 17 Dec 2025 11:24:19 +0000

RELEASE NOTES

OTOBO 11.0.14 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

December 17, 2025
Patch Level Release
OTOBO 11.0.14

Changes

[Changes] Improved default table styling in the RichText editor
Tables in the RichText editor now use an updated default styling. This improves readability and ensures a more consistent appearance, especially for documentation and structured ticket information. [#4800]
[Change] CKEditor 5 now generates HEX color styles instead of HSL for improved compatibility. [#4766]

Enhancements

[Enhancement] New transition action “TicketPrioritySet”
Ticket priorities can now be set automatically within processes. [#4896]
[Enhancement] Extended use of ticket reference fields
In the DynamicFieldSet transition action, ticket reference fields can now be used to define the TicketID. [#4818]
[Enhancement] Improved search accessibility
The Elasticsearch search box now supports an access key for faster and more convenient use. [#4810]

Bug Fixes

[Bugfix] Minor fixes in the High Contrast skin to improve accessibility. [#4899]
[Bugfix] Charts in reports now work correctly again in the default Docker environment. [#4890]
[Bugfix] Calendars are now fully configurable: administrators can manage all groups (new: LightAdmin functionality). [#4724]
[Bugfix] Dynamic fields with namespaces can again be used as filters in statistics. [#4844]
[Bugfix] Fixes for MultiValue set templates in the CustomerTicketProcess. [#4866]
[Bugfix] Fixed an issue where AJAX updates for set fields did not work in the CustomerTicketProcess. [#4868]
[Bugfix] More flexible CSS generation in the login area without a hardcoded default skin. [#4797]

Notes

Some dependencies have been updated. If ITSMConfigurationManagement is in use, it should also be updated in order to use the updated CodeMirror editor for editing ConfigItem definitions.

Next steps

Update to OTOBO 11.0.14

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 11.0.13

Pia Cebic — Thu, 23 Oct 2025 13:41:07 +0000

RELEASE NOTES

OTOBO 11.0.13 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 11.0.13

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

Alternative:
Instead of updating OTOBO, you can simply set OTOBO_IMAGE_REDIS=redis:8-bookworm in your .env file in the otobo-docker directory, then run: docker-compose down; docker-compose up -d to switch the Redis image.
Also, you can completely disable Redis by commenting out the line $Self->{'Cache::Module'} = [...] in your Kernel/Config.pm.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Enhancements

[Enhancement] Dynamic Lens fields are now also available for customer and customer user reference fields. [#4705]

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]
[Bugfix] Editing an article no longer triggers an unread icon in the toolbar. [#4688]
[Bugfix] Fixed a validation logic error for mandatory dynamic fields with regex checks. [#4751]
[Bugfix] Automatic linking of reference dynamic fields now works correctly with multiple values. [#4759]

Next steps

Update to OTOBO 11.0.13

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 11.0 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 10.1.16

Pia Cebic — Thu, 23 Oct 2025 13:40:51 +0000

RELEASE NOTES

OTOBO 10.1.16 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 10.1.16

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]

Next steps

Update to OTOBO 10.1.16

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 10.1.16 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 10.0.27

Pia Cebic — Thu, 23 Oct 2025 13:40:36 +0000

RELEASE NOTES

OTOBO 10.0.27 – Patch Level Release

PUBLISHED:
RELEASE TYPE:
RELEASE:

October 23, 2025
Patch Level Release
OTOBO 10.0.27

Docker Maintenance

More Security with Redis 8

We are upgrading from Redis 6.0 to Redis 8 as the default caching module for Docker, since the older version is affected by a critical security vulnerability (CVE-2025-49844).

Benefit:
No additional configuration is required — OTOBO will now ship with Redis 8 by default.

MariaDB Update to lts-noble (version 11.8.3)

The previous MariaDB image (10.5) has been replaced with lts-noble.

⚠️ Important: The MySQL client is no longer included in this image — it has been replaced by the MariaDB client.

If you have configured additional backup or maintenance jobs, please update the corresponding commands:
mysqladmin → mariadb-adminmysqldump → mariadb-dump

NGINX now Based on Debian 13

The update of the nginx-mainline Docker image to Debian 13 “Trixie” as the base image has now also been applied to our otobo-nginx image.

With these changes, your OTOBO installations remain secure, up-to-date, and future-proof — without adding any extra complexity.

Bug Fixes

[Bugfix] Fixed the permission check in AgentElasticsearchQuickResult: the system now checks CustomerUserInfo instead of AdminCustomerUser.[#4768]

Next steps

Update to OTOBO 10.0.27

We recommend updating your system to the latest version.

➞ Download Patch

OTOBO 10.0.27 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Security Patch? System-Update?
You don’t have to handle it on your own.

For our support customers: simply open a ticket through the portal or give us a quick call — we’re here to help.

Not working with us yet? This might be the perfect time. We’ll be happy to support you with your next update.

Get in touch — we look forward to hearing from you!

Contact

OTOBO 11.0.12

Pia Cebic — Thu, 25 Sep 2025 09:59:45 +0000

SECURITY ADVISORY

OTOBO 11.0.12 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 11.0

Description

[Security | medium] Fix for a potential privilege escalation via backup.plA potential security vulnerability has been closed, which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. by modifying the sudoers file) – potentially enabled a command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

[Security | medium] Incorrect group assignment with LDAP-Sync and Nested Group Search
We fixed an issue where users were assigned too many groups when LDAP-Sync was used with the NestedGroupSearch option enabled in the Config.pm. The cause was a bug that always inherited nested groups to users already assigned to the parent group.
Only installations that authenticate agents via LDAP, use the LDAP-Sync module, and have NestedGroupSearch enabled are affected.
Standard systems without this configuration are not affected.
Thanks to our partner FREICON for reporting this! [#4695]

Enhancements

[Enhancement] More detailed database information in the Support Data Collector
The Support Data Collector now provides extended details about the database in use. This makes it easier to analyze system environments in support cases. [#4681]

Changes

[Changes] Adjusted linking for reference dynamic fields
The target pages of the reference dynamic fields for CustomerUser and CustomerCompany have been updated: instead of pointing to the administration pages, the links now lead directly to the corresponding Information Centers. [#4564]

Bug Fixes

[Bugfix] Customer ticket form: Fixed an issue where no tickets could be created if a DateTime field was hidden and past dates were not allowed. [#4238]
[Bugfix] Mobile view: Adjusted widths for CKEditor and attachment uploads in agent ticket masks. [#4238]
[Bugfix] Dynamic fields with grids: Fixed a bug that could cause an Internal Server Error in AgentTicketSearch and ticket overviews. [#4572]
[Bugfix] Webservices: Multiselect fields now work correctly. [#4668]
[Bugfix] TicketMenu in AgentTicketZoom: Fixed configuration of item order within a cluster. [#4444]
[Bugfix] System configuration: Saving a setting as a favorite works again. [#4130]
[Bugfix] TicketACL::Autoselect: Dynamic fields that were automatically selected are now properly hidden, even when part of a set or multivalue field. [#4485]
[Bugfix] Article table: If article creation fails midway, the table is now properly tidied up. [#4596]
[Bugfix] Reference fields: Standard link creation now also works for multivalue fields. [#4590]
[Bugfix] Translations: Services and SLAs are now translated correctly in more places. [#4580]
[Bugfix] Transition actions: Passing DynamicField_Name_Data now works as expected. [#4577]
[Bugfix] AgentTicketArticleEdit did not correctly enforce all article restrictions. (An agent who owned a ticket could, for example, wrongfully edit email articles.) [#4722]
[Bugfix] Validation of mandatory multi-value fields unified: Backend validation has been aligned with frontend validation. Previously, a mandatory field such as ['A','','C'] could be stored, as it was technically considered to “have a value” even if one index remained empty. [#4515]
[Bugfix] Display of code blocks in monospace: Code blocks were not displayed in monospace in HTML views of zoom masks and in CKEditor 5. [#4405]

Next steps

Update to OTOBO 11.0.12

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 11.0

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 10.1.15

Pia Cebic — Thu, 25 Sep 2025 09:56:50 +0000

SECURITY ADVISORY

OTOBO 10.1.15 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

September 25, 2025
Security Patch Release
MEDIUM
OTOBO 10.1

Description

[Security | high] Fix for potential privilege escalation via backup.pl
We have closed a potential security vulnerability which – only on systems configured to allow backup.pl to be executed with root permissions by any user (e.g. through modifications in the sudoers file) – potentially enabled a command injection. This could allow standard users on the OTOBO server to execute arbitrary commands with root privileges.
Standard installations are not affected.
Thanks to Diego Berger Tellaroli for reporting this issue! [#4619]

[Security | medium] Incorrect group assignment with LDAP-Sync and Nested Group Search
We fixed an issue where users were assigned too many groups when LDAP-Sync was used with the NestedGroupSearchoption enabled in the Config.pm. The cause was a bug that always inherited nested groups to users who were already assigned to the parent group.
Only installations that authenticate agents via LDAP, use the LDAP-Sync module, and have NestedGroupSearch enabled were affected.
Standard systems without this configuration are not affected.
Thanks to our partner FREICON for reporting this! [#4695]

Changes

[Change] Docker: Upgraded the Perl base image to 5.38-bookworm. [#4512]

Bug Fixes

[Bugfix] System Configuration: Fixed an issue where saving a setting as a favorite did not work. [#4130]
[Bugfix] AgentTicketActionCommon: Fixed a bug where the type update did not respect current parameters when saving. [#4359]
[Bugfix] Article handling: The article table is now properly tidied up if article creation fails midway. [#4596]
[Bugfix] OpenID Connect: Corrected login form behavior and improved misleading error messages shown after a browser restart. [#4393]
[Bugfix] DynamicField Webservice: Fixed a bug affecting the proper handling of DynamicField webservices. [#3446]

Next steps

Update to OTOBO 10.1.15

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.1 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

Release Notes – OTOBO

OTOBO 11.1 Beta

OTOBO 11.1 (Beta)

What’s new in OTOBO 11.1 (Beta)

Ticket Handling – Better Overview, Faster Results

Process Management – Model with Precision, Control with Confidence

Dynamic Fields – Information Precisely Where Needed

Security – Modern Authentication, Secure Connectivity

Data Exchange and Integration – Significantly Simplified

Technical Notes

Changes

Enhancements

Next steps

Update, Upgrade, or Questions? We’re here.

OTOBO 11.0.16

OTOBO 11.0.16 – Security Patch

Security Fixes

Enhancements

Changes

Bug Fixes

Next steps

Update to OTOBO 11.0.16

OTOBO 11.0

OTOBO 10.1.17

OTOBO 10.1.17 – Security Patch

Security Fixes

Enhancements

Bug Fixes

Next steps

Update to OTOBO 10.1.17

OTOBO 10.1 Change Log

Security patch? System update? No need to handle it alone.

OTOBO 11.0.15

OTOBO 11.0.15 – Patch Level Release

Enhancements

Bug Fixes

Next steps

Update to OTOBO 11.0.15

OTOBO 11.0 Change Log

Security patch? System update?You don’t have to handle it on your own.

OTOBO 11.0.14

OTOBO 11.0.14 – Patch Level Release

Changes

Enhancements

Bug Fixes

Notes

Next steps

Update to OTOBO 11.0.14

OTOBO 11.0 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 11.0.13

OTOBO 11.0.13 – Patch Level Release

Docker Maintenance

Enhancements

Bug Fixes

Next steps

Update to OTOBO 11.0.13

OTOBO 11.0 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 10.1.16

OTOBO 10.1.16 – Patch Level Release

Docker Maintenance

Bug Fixes

Next steps

Update to OTOBO 10.1.16

OTOBO 10.1.16 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 10.0.27

OTOBO 10.0.27 – Patch Level Release

Docker Maintenance

Bug Fixes

Next steps

Update to OTOBO 10.0.27

OTOBO 10.0.27 Change Log

Security Patch? System-Update?You don’t have to handle it on your own.

OTOBO 11.0.12

OTOBO 11.0.12 – Security Patch

Description

Enhancements

Changes

Update, Upgrade, or Questions?
We’re here.

Security patch? System update?
No need to handle it alone.

Security patch? System update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security Patch? System-Update?
You don’t have to handle it on your own.

Security patch? System update?
No need to handle it alone.