OTOBO

OTOBO 11.1.0 Beta2

Pia Cebic — Mon, 27 Jul 2026 11:28:57 +0000

SECURITY ADVISORY

OTOBO 11.1.0 (Beta2) – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

July 27, 2026
Security Patch Release
LOW
OTOBO 11.1 Beta

Security Fixes

[Security] SessionID binding for web upload cache – Previously, the cache was being protected only by a cryptographically insecure random number, allowing authenticated attackers to guess it and access other users’ attachments during article creation. This vulnerability has been fixed. [#5835]
[Security] Avoid recursion in the template generator / CVE-2025-26843 – Fixed a Denial of Service (DoS) vulnerability in ticket notifications and auto responses that allowed attackers to trigger infinite loops. [#5797]
[Security] FormdraftID – A vulnerability has been fixed that previously allowed authenticated agents to delete drafts belonging to other users. [#5675]
[Security] XSS vulnerabilities – Two XSS vulnerabilities have been fixed, one in AgentTicketEmailResend and one in the admin communication log. [#5791] [#5790]
[Security] POST forms – POST forms have been added for article and ticket actions, closing CSRF vulnerabilities on the MarkAsImportant and QuickClose actions. [#5817]
[Security] SysConfig deployment – A permission check has been added to SysConfig deployment, closing a gap in the deployment process. [#5818]

Changes

[Change] Queue and Service selection – The order of Queue and Service selection has been swapped across all forms. [#5840]
[Change] FormDraft API – FormDraft methods now require the correct object ID to be provided. [#5825]

Bugfixes

[Bugfix] Ticket Info widget – Fixed an issue with how the Ticket Info widget in CustomerTicketZoom was displayed. [#5000]
[Bugfix] Text Indent – Indent buttons in CKEditor are working again. [#5438]
[Bugfix] OIDC Login Redirect – No more double URL-encoding. [#5787]
[Bugfix] TicketAppointments-Event – The event is no longer triggered multiple times by mistake. [#4220]

Enhancements

[Enhancement] The “DynamicFieldSet” transition action now includes an “ExternalSource” parameter, enabling the system to interpret passed values as an external source. [#5882]
[Enhancement] Transition Action TicketCustomerSet is now also compatible with reference fields provided via _Data tag. [#5902]

Next steps

Update to OTOBO 11.1.0 Beta2

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 11.1 Beta

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 11.0.17

Pia Cebic — Mon, 27 Jul 2026 11:28:10 +0000

SECURITY ADVISORY

OTOBO 11.0.17 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

July 27, 2026
Security Patch Release
LOW
OTOBO 11.0

Security Fixes

[Security] SessionID binding for web upload cache – Previously, the cache was being protected only by a cryptographically insecure random number, allowing authenticated attackers to guess it and access other users’ attachments during article creation. This vulnerability has been fixed. [#5835]
[Security] Avoid recursion in the template generator / CVE-2025-26843 – Fixed a Denial of Service (DoS) vulnerability in ticket notifications and auto responses that allowed attackers to trigger infinite loops. [#5797]
[Security] FormDraftID – A vulnerability has been fixed that previously allowed authenticated agents to delete drafts belonging to other users. [#5675]
[Security] XSS vulnerabilities – Two XSS vulnerabilities have been fixed, one in AgentTicketEmailResend and one in the admin communication log. [#5791][#5790]
[Security] AgentTicketBulk – Previously, the bulk action made it possible for agents to link tickets to another ticket they did not have access to. This missing permission check has been added. [#5723]
[Security] SysConfig deployment – A permission check has been added to SysConfig deployment, closing a gap in the deployment process. [#5818]

Changes

[Change] SystemConfiguration – Translation has been disabled for SystemConfiguration values within AdminSystemConfiguration. [#5641]

Bugfixes

[Bugfix] DynamicField Database – Sorting of PossibleValues in the DynamicField Database details view has been fixed. [#5642]
[Bugfix] Personal Preferences – Certain personal preferences of other agents failed to persist when edited by an admin. This issue has been fixed. [#5430]
[Bugfix] Dynamic Field Ticket Categories – Color selection and translation are no longer failing for longer values due to truncation. [#5329]
[Bugfix] Ticket Info widget – Fixed an issue with how the Ticket Info widget in CustomerTicketZoom was displayed. [#5000]
[Bugfix] AgentTicketArticleEdit: – For edited articles, the original author was always shown as editor also. This has been fixed. [#5620]
[Bugfix] DynamicField Import – Update Events are now set for Script Dynamic Fields upon import. [#5485]
[Bugfix] DynamicField Text – New multivalue items start empty now instead of being pre-filled with the value of the previous item. [#5551]
[Bugfix] DF Reference Agent – Works without filtering for groups now, too. [#5469]
[Bugfix] Network Transport Endpoint – Is no longer limited to 250 characters. [#5262]
[Bugfix] “Show deleted articles” button – Can be deactivated again. [#5445]
[Bugfix] Text Indent – Indent buttons in CKEditor are working again. [#5438]
[Bugfix] TicketAppointments-Event – The event is no longer triggered multiple times by mistake. [#4220]

Enhancements

[Enhancement] Transition Action DynamicFieldSet allows a value to be interpreted as an “external source” key, by providing “ExternalSource” as additional parameter in the dynamic field settings. [#5882]
[Enhancement] Transition Action TicketCustomerSet is now also compatible with reference fields provided via _Data tag. [#5902] .

Next steps

Update to OTOBO 11.0.17

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 11.0

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 10.1.18

Pia Cebic — Mon, 27 Jul 2026 11:27:25 +0000

SECURITY ADVISORY

OTOBO 10.1.18 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

July 27, 2026
Security Patch Release
LOW
OTOBO 10.1

Security Fixes

[Security] SessionID binding for web upload cache – Previously, the cache was being protected only by a cryptographically insecure random number, allowing authenticated attackers to guess it and access other users’ attachments during article creation. This vulnerability has been fixed. [#5835]
[Security] Avoid recursion in the template generator / CVE-2025-26843 – Fixed a Denial of Service (DoS) vulnerability in ticket notifications and auto responses that allowed attackers to trigger infinite loops. [#5797]
[Security] FormDraftID – A vulnerability has been fixed that previously allowed authenticated agents to delete drafts belonging to other users. [#5675]
[Security] XSS vulnerabilities – Two XSS vulnerabilities have been fixed, one in AgentTicketEmailResend and one in the admin communication log. [#5791][#5790]
[Security] AgentTicketBulk – Previously, the bulk action made it possible to link tickets to another ticket the agent did not have access to. This missing permission check has been added. [#5723]
[Security] SysConfig deployment – A permission check has been added to SysConfig deployment, closing a gap in the deployment process. [#5818]

Changes

[Change] SystemConfiguration – Translation has been disabled for SystemConfiguration values within AdminSystemConfiguration. [#5641]

Bugfixes

[Bugfix] DynamicField Database – Sorting of PossibleValues in the DynamicField Database details view has been fixed. [#5642]
[Bugfix] Personal Preferences – Certain personal preferences of other agents failed to persist when edited by an admin. [#5430]
[Bugfix] Dynamic Field Ticket Categories – Fixed an issue where color selection and translation failed for longer values due to truncation. [#5329]

Next steps

Update to OTOBO 10.1.18

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.1

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?

No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 11.1 Beta

Pia Cebic — Wed, 24 Jun 2026 13:52:14 +0000

RELEASE NOTES

OTOBO 11.1 (Beta)

More Power for Your Service Management

RELEASE DATE:
RELEASE TYPE:
RELEASE:

24 June 2026
Beta Release
11.1 (Beta)

OTOBO 11.1 is packed with quality-of-life improvements and delivers real value in modeling, integration & system connectivity, and administration.

What’s new in OTOBO 11.1 (Beta)

HIGHLIGHT 1

Ticket Handling – Better Overview, Faster Results

Fewer clicks, more context, faster decisions. And this is just the beginning. With version 11.1, working within the ticket – where agents spend the majority of their day – is now faster and more intuitive.

Elasticsearch – Search at a New Level
Additional dialogues, field-based queries, and an extended syntax – for example Title:Test* AND Body:Test* or Boolean operators with AND / NOT – make the fast, concurrent search more precise. Anyone using Elasticsearch will notice the difference immediately.

Similar Tickets – Always in Sight
Powered by Elasticsearch, the new ‘Similar Tickets’ widget displays related tickets directly in the Ticket Zoom view. This eliminates the need for manual searches, as similar tickets are shown automatically. It is one of the tasks soon to be handled by the OTOBO AI, Roboto.

Full Control Over the Ticket History
Article editing, including time tracking, is now a standard feature – no separate package required. Ticket articles can be edited, deleted, or pinned directly within the Ticket Zoom view. Easily correct mistakes, remove clutter, and keep key information in sight to ensure your ticket history stays clear and organized.

Filters That Work for You
In ticket lists, multiple filters can now be set parallely. Configure them once, enjoy the perfect view permanently. No more manual re-filtering, no more searching through long lists. The right view is always just one click away.

HIGHLIGHT 2

Process Management – Model with Precision, Control with Confidence

With 11.1, process management in OTOBO evolves significantly – in maturity, flexibility, and the depth to which processes can be modeled. Anyone building and maintaining complex processes will notice the difference immediately.

Structure Processes, Maintain a Clear Overview
As complex process setups grow, they can quickly become cluttered. Namespaces logically group process elements, ensuring admins keep a clear overview even within highly intricate workflows.
Global or Process-Specific – You Decide
Process elements can now be marked as either global or process-specific. A simple checkbox determines whether an element should be available across all processes – or restricted to a specific one.
Logical Transitions
Transitions now support Not, Any, and All logic – including checks for empty fields. Dynamic fields within a set can be addressed directly via Field1::Field2. The result: process logic that fits reality – not the other way around.

Templates That Work Everywhere
The ticket templates you know and love can now also be used in process dialogs. Using templates ensures that content is captured cleanly from the very start.
Customers See What They Need
Process and activity details can now be hidden within the customer interface. Customers see exactly what they need – and nothing that distracts them. The result: fewer inquiries, fewer misunderstandings, reduced support overhead.
Less Searching, More Control
Anyone managing large numbers of processes knows the pain point: searching takes up valuable time. Improved sorting for process elements in the admin area completely eliminates this issue – making elements faster to find and keeping management straightforward, even as complexity grows.

HIGHLIGHT 3

Dynamic Fields – Information Precisely Where Needed

In OTOBO, we call them “Dynamic Fields” – but they are so much more. These fields only display when and just where they are needed. Provide information on linked objects directly within the ticket. Build forms that seamlessly adapt to the context. With 11.1, Dynamic Fields turn even more powerful.

Only What’s Relevant – At the Right Moment
Dynamic Fields of the “Reference” type link FAQ articles, services, customers, customer users, or ConfigItems directly to a ticket, or to each other. Lenses provide instant insight into the details of these linked elements – without ever needing to open the object itself. Fewer clicks, no context switching – all relevant information precisely where it’s needed. The result: reduced handling time per ticket and more time for customers.

HIGHLIGHT 4

Security – Modern Authentication, Secure Connectivity

With 11.1, OTOBO takes security and authentication to the next level. Modern standards, centralized management, and encrypted connectivity – no workarounds, no third-party packages.

Manage Tokens Centrally – OAuth Token Management
OTOBO now features a dedicated token management system. Tokens enable secure authentication with external services – covering email connectivity via POP, IMAP – now also SMTP –, as well as outgoing web services. No more expired passwords, no searching through scattered configurations, and zero administrative overhead when passwords change. Everything is centralized – everything is under control.
One Login for Everything – OpenID Connect
Logging into OTOBO via OpenID Connect enables Single Sign-On (SSO) for both agents and customers. No separate OTOBO passwords required – instead, it offers a seamless integration into your existing corporate authentication. One login, all systems, no password chaos.

Encrypted Database Connectivity
The DB backend transitions from DBD::mysql to DBD::MariaDB – actively maintained, more modern, and optimized for current database versions. Encrypted connectivity for both MySQL and MariaDB is now available, with authentication plugins selectable directly within the installer. Sensitive data remains secure – without the need for manual workarounds.
OTOBO and OTOBO Docker – Now Independent
Starting with 11.1, OTOBO and OTOBO Docker feature independent release cycles. Updates can be applied completely separate from one another – eliminating dependencies between the two. Expect clearer version details in example files, greater maintenance flexibility, and continuously updated ‘latest’ images.

HIGHLIGHT 5

Data Exchange and Integration – Significantly Simplified

OTOBO 11.1 simplifies data exchange – both incoming and outgoing. It brings enhanced compatibility with external systems and full control over configurations and objects. All included as standard, with no extra packages required.

Web Services That Adapt
Attachments can now be transferred via multipart/form-data – a prerequisite for direct integration with JIRA, OpenProject, and other systems that require this specific format. For outgoing data, you can now enforce specific formats such as arrays to ensure the interface receives exactly what it expects. Additionally, OAuth is now available as a supported authentication method for outgoing web services.

Export Configurations – And Reuse Them
Entire configuration packages – including processes, Dynamic Fields, notifications, queues, and ACLs – can now be exported to .csv files and imported back into the system. This can be done directly within the respective settings screen – no detours, no manual rebuilding.
Export Objects – Migration Made Easy

Moving forward, tickets, customers, customer users, and ConfigItems can be seamlessly transferred directly under Admin → Import/Export. Whether for a migration or straightforward data exchange – starting with 11.1, both are available out of the box in the OTOBO standard.

Technical Notes

The update process will create a new folder structure – any manual customisations must be packaged in advance or reapplied afterwards.

The MailAccountOAuth2 package has been integrated into the standard – manual adjustments are required during the upgrade.

Changes

[Change] Caching in the file system instead of Redis Cache for Docker based installations [#5728]
[Change] Improved file handling for OTOBO updates [#5077]
[Change] Replacement of the MailaccountOAuth2 package – see warning above! [#5652]
[Change] Reworked article actions sysconfig structure [#5126]
[Change] Support for SessionUseCookie = 0 removed [#4426]

Enhancements

[Enhancement] OIDC/Oauth2 authentication for web services [#4450]
[Enhancement] Process Management: Global vs. local scoping and namespaces for process elements [#5589]
[Enhancement] Process transition validation now supports additional array operators and make them work with DynamicField Sets. [#5590]
[Enhancement] Ticket lists support multiple filters now [#1831]
[Enhancement] Integrated Elasticsearch-Extension package into the core [#5350]
[Enhancement] New: Elasticsearch Similar Tickets Widget [#5508]
[Enhancement] Integrated ProcessTicketTemplates package into the core – use ticket templates in process dialogues, too [#5436]
[Enhancement] Integrated CustomerTicketSearch package into the core – full-text search in the customer interface [#5161]
[Enhancement] Integrate package ExtendedArticleEdit into core – edit the text of external articles (not for emails), article dynamic fields, and further attributes as well as their visibility [#4258]
[Enhancement] Include Package CK5-FullWindowMode into core – maximise the editor mask [#5415]
[Enhancement] New: Checklists in CK5 Editor [#5415]
[Enhancement] Include Package TicketUpdateOperationExternalIdentifier into core – supporting external identifiers in automatic ticket updates via external systems [#5413]
[Enhancement] Include package ImportExportStandardObjects into core – easy import/export for standard objects [#5148]
[Enhancement] Include package ImportExportCustomerCompany into core – easy import/export for customer companies [#5005]
[Enhancement] Include package PostMasterXFromHeader into core – set the customer user automatically based on information within the email body [#5008]
[Enhancement] Show/Hide Inner Set Fields – ACLs supported for Dynamic Fields within Sets now, too [#5524]
[Enhancement] Enable HideShow for AgentTicketCompose – ACLs supported in the Reply mask in the agent interface [#3537]
[Enhancement] Customer interface: Ticket age switches to create time in ticket lists automatically after a configurable amount of time (default 24h) [#1826]
[Enhancement] Selection of DB authentication plugin in the installer is supported [#5102]
[Enhancement] Ticket templates support defining the next ticket state now [#5542]
[Enhancement] Lens Fields can point directly to Reference Fields now, too [#3186]
[Enhancement] Lens Fields can point directly to Sets now [#4910]
[Enhancement] You can set the exact datatype for web services in XSLT now (Boolean, array) [#5507]
[Enhancement] Web services support multipart/formdata as well now (attachments!) [#5444]
[Enhancement] Added validity state for PostMaster Filters [#4200]
[Enhancement] Added a StopAfterMatch indicator in AdminPostMasterFilter Overview [#1618]
[Enhancement] Customer interface: Dynamic fields for the Reply Dialogue can be added in DynamicFieldScreens now [#4355]

OTOBO 11.1.0 (Beta2) – Security Patch Release

➞ More Informations

Thank you to the community and all contributors!
Now it’s time to: test the Beta, share your feedback – so the stable release can follow soon.

Next steps

Update to OTOBO 11.1

We recommend updating your system.

➞ Download

OTOBO 11.1 Change Log

A comprehensive overview of all current and past changes.

➞ All Changes

Update, Upgrade, or Questions?
We’re here.

Support customers can simply get in touch via the portal or give us a quick call. No support contract yet? Perhaps now is the right time.

Kontakt

Perl Developer | Fullstack

Pia Cebic — Sun, 10 May 2026 09:08:12 +0000

JOB OPPORTUNITY

Perl Developer | Fullstack (m/f/d)

Permanent position (32–40 hours/week)
Start date: as soon as possible
Work location: on-site, hybrid, or remote

Tech stack: Perl, JavaScript, jQuery, HTML5, CSS

Perl is close to your heart and you’ve always wanted to be part of a real open-source project?
Then this might be just the place for you:

As the Source Code Owner and Maintainer, we are the driving force behind the open-source service management platform OTOBO – used by organisations worldwide to manage critical services and workflows. Our growing team works closely with customers and the international community to continuously move the project forward.

Ready to join us?

Your role

Help us shape the future of a software that truly matters – yesterday, today and tomorrow.

OTOBO has been around since 2019, and its codebase has proven itself for more than 20 years. It solves real-world problems and helps users stay on top of their daily workload.

We continue to evolve the standard and build solutions for specific challenges across a wide range of sectors – pragmatic, agile and sustainable. With clean code that integrates seamlessly into the wider project and delivers value for everyone.

Here are some of the things you can expect to work on:

You develop solutions that truly fit – for municipalities and universities, mechanical engineering companies, hospitals and the CERT teams of DAX-listed companies
You implement features that meet specific project requirements while also adding to the broader, general-purpose framework
You focus on long-term solutions, open standards and open protocols
You make sure our Perl code hums like a happy camel – reliable, stable and with perfectly placed humps (sub and return, of course)
You use JavaScript, jQuery, HTML5, and CSS to give OTOBO a frontend that lives up to its inner strengths
You investigate and resolve user-reported issues and review and merge pull requests from partners and the community

What we’re looking for

Formal education is secondary to us. What matters most is deep expertise in Perl and other scripting languages such as JavaScript, jQuery, HTML5 and CSS
At the moment, experience with OTOBO or related platforms is a must-have requirement
You are passionate about open-source and enjoy exploring what’s possible with it
You enjoy tackling complex challenges and are keen to dive into a wide variety of projects
You communicate confidently in English – our development team is international
You are a true team player who enjoys collaborating with others
You work independently like a pro, but are always willing to step out of your coding cave for meaningful exchange
You don’t just fix problems – you understand the root cause and make sure they don’t happen again

How we work together

Here’s your rare opportunity to work on a true open-source project: as the Source Code Owner and Maintainer, we stand behind OTOBO, continuously develop the platform and provide related business services.

What matters to us: OTOBO is 100% license-free and open-source – and it will stay that way.

You develop feature add-ons for specific customer projects – agile and efficiently. If you like, also in direct contact with customers, often in a way that allows them to become part of the standard later on
You create sustainable solutions that integrate smoothly into the existing codebase and remain flexible enough to work across different scenarios
You work in an owner-managed company with stable financing. No start-up hype. No plans to sell to the highest bidder in two years. Instead: real-world use cases and close collaboration with the global community
We work in a distributed setup – part of the team regularly works from the office, others mostly remotely (Germany, Ireland and Portugal). We stay in close daily contact via our chat platform Element and our video platform BigBlueButton. In our weekly team call, we share updates across all OTOBO projects
You track your working hours independently
How you organise your day-to-day work is up to you
Around four times a year, we meet in person at our office on a historic farmstead – because strong team spirit matters to us

Who we are

Rother OSS GmbH | Team OTOBO is the company behind the open-source service management platform OTOBO. Founded in 2011, the company is owner-managed.

As the Source Code Owner and Maintainer, we support the open-source project and continuously evolve the standard together with partners and the community. At the same time, we guide customers through implementation and customisation, day-to-day operations and the targeted expansion of the platform.

Our home base is a historic traditional three-sided farm courtyard near Straubing. With its tower staircase, round windows, natural swimming pond and Harry at the front door, our office is as unique as we are – and so are our ways of working.

While our user base continues to grow, the OTOBO team has remained small and close-knit. We firmly believe that collaboration and shared knowledge are stronger than competition and silos – and that real innovation happens when people work together with confidence and a positive outlook for the future.

What else defines us? Hands-on, refreshingly approachable and genuinely good-humoured.

In everything we do, we value ownership, high quality and mutual appreciation.

Learn more about us here.

Application

Sounds interesting? Apply now!

We’re looking forward to getting to know you!

Rother OSS GmbH
Human Resources
Grit Rother
Oberwalting 31
94339 Leiblfing

Germany

+49 9427 68 39 000

jobs@otobo.io

Previous Next

1 2 3 4 5 6

Open Kernel – OTOBO Enterprise Partner in Hungary

Pia Cebic — Wed, 06 May 2026 15:49:03 +0000

NEWS | COMPANY

Open Kernel – New OTOBO Enterprise Partner in Central and Eastern Europe

OTOBO welcomes Open Kernel, an experienced service management team with a strong focus on open-source solutions, as new Enterprise Partner

Open Kernel – the former OTRS Hungary team – has been active in service management since 2014 and brings extensive experience from the OTRS ecosystem, including complex implementations and customisations. Now, as an independent company, they provide open-source customer service solutions to clients in Hungary and beyond.

New Chapter for Former OTRS Hungary Team

Since January 2026, the former OTRS Hungary team has been operating as the independent consulting company Open Kernel. With over a decade of experience, the team combines technical implementation expertise with business and process know-how and includes specialists in coaching, information security, business administration and product ownership, as well as ITIL®-certified professionals.

While the organisational setup has changed, their core focus remains unchanged: improving communication between organisations and their customers – now with a clear focus on open-source solutions. They support organisations in improving service quality, helping them respond faster and deliver a better customer experience.

„Open source gives organisations the flexibility and independence they need to build affordable, sustainable service management solutions.“

László Gyaraki, Managing Director, Open Kernel

Typical projects include implementing and consulting on service management platforms, system migrations and introducing structured ITSM practices such as SLA management and service automation to automate workflows and improve response times.

Open-Source Commitment and Active Contribution

With the launch of Open Kernel, the team decided to focus on open-source service management solutions – and to actively engage with OTOBO.

They value OTOBO’s open-source model, its active community and the flexibility of the platform, which allows organisations to adapt it to their specific requirements:

„With OTOBO, we see a strong, stable and fast-growing platform, as well as a maintainer and community that share this vision.”

László Gyaraki, Managing Director, Open Kernel

This approach has long been an integral part of their work. Their experience in contributing to projects and working in collaborative communities now strengthens the OTOBO project.

Open Kernel already contributes to documentation and translations – areas where the team brings long-standing experience from previous roles. By doing so, they help improve accessibility, expand translations and further develop the platform.

Strengthening the OTOBO Partner Network

With their experience in service management and a strong focus on open-source solutions, Open Kernel strengthens the OTOBO partner network in Central and Eastern Europe.

„The Open Kernel team combines deep service management expertise with a genuine commitment to open source. Their technical know-how and long-standing experience make them a strong partner and valuable addition to the Community.”

Stefan Rother, CEO at Rother OSS GmbH | Team OTOBO

Together with Open Kernel, OTOBO continues to expand its ecosystem – sharing expertise and driving the development of modern service management by promoting individual solutions based on common practice.

We look forward to working closely with Open Kernel. A very warm welcome to the partner community!

OTOBO 11.0.16

Pia Cebic — Thu, 23 Apr 2026 09:32:52 +0000

SECURITY ADVISORY

OTOBO 11.0.16 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

April 23, 2026
Security Patch Release
MEDIUM
OTOBO 11.0

Security Fixes

[Security] Updated Compress::Raw::Zlib to address CVE-2026-3381 in Docker environments – The dependency Compress::Raw::Zlib has been updated to close a vulnerability that could affect Docker-based OTOBO installations. Non-Docker systems are generally not affected. [#5269]
[Security] Updated Mozilla::CA – The optional dependency Mozilla::CA, suggested as default configuration in several places, has been updated to the latest version to keep the certificate store current. [#5245]
[Security] CVE-2025-59490: Fixed XSS vulnerabilities – We closed cross-site scripting (XSS) vulnerabilities allowing attackers to execute malicious code in users’ browsers after those clicking on malicious links. All users are strongly advised to update to this version. [#5358, #5419]
[Security] CVE-2025-59393: Improved password masking in the Support Bundle generator – Passwords and sensitive credentials are now more reliably redacted when generating a support bundle, preventing accidental exposure of access data. [#5376]
[Security] Removed stack traces from frontend error messages – Stack traces are no longer exposed in frontend error messages, as they could reveal internal system information and potentially serve as an attack vector. [#5359]

Enhancements

[Enhancement] Improved output in the database update script for rel-11_0 – The database update script for rel-11_0 now provides more meaningful feedback during execution, making it significantly easier to diagnose issues and track update processes. [#5208]
[Enhancement] Support for connect attributes in non-primary databases – Connection attributes can now be configured for non-primary databases as well, enabling more flexible and granular control over database connections. (Users running multiple databases in OTOBO – e.g. a separate one for archive data – can now define individual connection settings such as timeouts or character sets for each of these databases.) [#5110]

Changes

[Change] Email X-headers as an external source for dynamic fields – Email X-headers are now recognized and processed as an external data source for dynamic fields. This facilitates to also set dynamic reference fields via email parsing. [#5164]

Bugfixes

[Bugfix] Broken links to external icons and data leak – Broken links to external icons have been fixed and an associated data leak has been closed. [#5212]
[Bugfix] AgentTicketProcess and CustomerTicketProcess: hidden fields not displayed on initial page load – A bug has been fixed where hidden fields were not correctly shown when a process screen was loaded for the first time. [#5196]
[Bugfix] Leeway parameter was not passed when decoding JWT tokens – The leeway parameter is now correctly passed to JWT token decoding, resolving issues with time tolerance validation of tokens. [#5211]
[Bugfix] DF Ticket Reference: CustomerUserID is now correctly mapped to CustomerUserLogin for ticket search – When searching for tickets via dynamic fields with a ticket reference, the CustomerUserID was not correctly mapped to the CustomerUserLogin. This issue has been fixed. [#5300]
[Bugfix] DF CustomerUser Reference: external source attribute “Email” was not working – The “Email” attribute as an external source in dynamic fields of type CustomerUser Reference is now processed correctly. [#5273]
[Bugfix] DF CustomerUser Reference: implementation of FieldValueValidate – The FieldValueValidate function has been implemented for dynamic fields of type CustomerUser Reference to ensure correct value validation. [#5277]
[Bugfix] QueueDefault could prevent dynamic field values from being saved – A bug has been fixed where the use of QueueDefault prevented values in dynamic fields from being correctly persisted. [#4962]
[Bugfix] Queue set via URL did not correctly trigger ACLs in CustomerTicketMessage – When a queue was set via a URL parameter, associated ACLs were not reliably applied in the CustomerTicketMessage area. This issue has been fixed. [#5237]
[Bugfix] Quick date buttons were not working on the Responsible screen – The quick date buttons were non-functional on the screen for assigning responsible agents. This issue has been fixed. [#5221]
[Bugfix] ExternalURLJump: question marks and equals signs in configured links were not working – Special characters such as ? and = in ExternalURLJump links were not processed correctly. This issue has been fixed. [#5203]
[Bugfix] Fixed UI issues with labels in CustomerTicketProcess – Various display errors affecting labels in CustomerTicketProcess have been corrected. [#4985]
[Bugfix] Deleting dynamic field attachments was not possible in the customer interface – Removing attachments in dynamic fields was not functional in the customer interface. This issue has been fixed. [#5348]

Next steps

Update to OTOBO 11.0.16

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 11.0

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

OTOBO 10.1.17

Pia Cebic — Thu, 23 Apr 2026 09:30:59 +0000

SECURITY ADVISORY

OTOBO 10.1.17 – Security Patch

PUBLISHING DATE:
RELEASE TYPE:
CRITICALITY:
AFFECTED VERSION:

April 23, 2026
Security Patch Release
MEDIUM
OTOBO 10.1

Security Fixes

[Security] Updated Compress::Raw::Zlib to address CVE-2026-3381 in Docker environments – The dependency Compress::Raw::Zlib has been updated to close a vulnerability that could affect Docker-based OTOBO installations. Non-Docker systems are generally not affected. [#5269 ]
[Security] Updated Mozilla::CA – The optional dependency Mozilla::CA, suggested as default configuration in several places, has been updated to the latest version to keep the certificate store current. [#5245]
[Security] CVE-2025-59490: Fixed XSS vulnerabilities – We closed cross-site scripting (XSS) vulnerabilities allowing attackers to execute malicious code in users’ browsers after those clicking on malicious links. All users are strongly advised to update to this version. [#5358, #5419]
[Security] CVE-2025-59393: Improved password masking in the Support Bundle generator – Passwords and sensitive credentials are now more reliably redacted when generating a support bundle, preventing accidental exposure of access data. [#5376 ]
[Security] Removed stack traces from frontend error messages – Stack traces are no longer exposed in frontend error messages, as they could reveal internal system information and potentially serve as an attack vector. [#5359 ]

Enhancements

[Enhancement] Display of Perl DBI database driver information in support data – Support data now includes detailed information about the Perl DBI database driver in use, making troubleshooting and the support process easier. [#5104]
[Enhancement] Added otobo-web/static URL for serving static files – Static files can now be served via the dedicated URL otobo-web/static, enabling a more flexible and performant web server configuration. [#5342]
[Enhancement] New console command Maint::Elasticsearch::TestConnection – The new console command allows the connection to Elasticsearch to be tested directly from the command line, simplifying administration and troubleshooting of Elasticsearch integrations. [#5340]

Bug Fixes

[Bugfix] Broken links to external icons and data leak – Broken links to external icons have been fixed and an associated data leak has been closed. [#5212]
[Bugfix] Queue set via URL did not correctly trigger ACLs in CustomerTicketMessage – When a queue was set via a URL parameter, associated ACLs were not reliably applied in the CustomerTicketMessage area. This issue has been fixed. [#5237]
[Bugfix] Agent name missing in system configuration setting history – The name of the person who made a change was not displayed in the change history of system configuration settings. This issue has been fixed. [#5071]
[Bugfix] Elasticsearch index tmpattachments was not managed by OTOBO – The Elasticsearch index tmpattachments was previously not managed by OTOBO, which could lead to inconsistencies. This has been corrected so that the index is now fully within OTOBO’s management scope. [#4326]

Next steps

Update to OTOBO 10.1.17

We recommend that you fix the vulnerabilities and benefit from the latest improvements. Please update your system.

➞ Download Security Patch

OTOBO 10.1 Change Log

A comprehensive overview of all present and past changes.

➞ See all changes

Security patch? System update?
No need to handle it alone.

As a support customer, just reach out via our portal or give us a quick call – we’re here to help.

Haven’t worked with us yet? Maybe now’s the perfect time. We’ll be happy to support your next update. Just get in touch – we’d love to hear from you!

Contact

Open Kernel, Hungary

Pia Cebic — Thu, 23 Apr 2026 06:47:10 +0000

ENTERPRISE PARTNER

Open Kernel

Headquarters:
Open Kernel Bt.
Bt. Petőfi Sándor utca. 12/1
5622, Köröstarcsa
Hungary
Foundation: 2026
Employees: 2-10
Contact: info@openkernel.hu
Website:
https://customerservice.hu/

Regional coverage:
Central-Eastern Europe
Services:
OTOBO Implementation, Consulting and Support
Partner Level: OTOBO Enterprise Partner

Open Kernel has been implementing customer service systems since 2014. The team initially became known under the name “OTRS-solutions”, and later operated as part of OTRS Hungary Ltd. from 2018 onwards.

In 2026, the entire Hungarian team transitioned into an independent consulting company in response to market changes. Today, Open Kernel focuses on delivering services around open-source customer service platforms in Central and Eastern Europe. Building on many years of experience and expertise, they offer flexible and scalable solutions tailored to individual customer needs.

The team combines technical and business expertise, including a certified coach, an information security engineer, an economist, a product owner, and several ITIL®-certified professionals.

Open Kernel’s purpose is to improve communication between companies and their customers. They believe that professional customer service strengthens a company’s reputation and creates a superior customer experience. Their mission is to deliver outstanding software solutions and expert support– while maintaining the same high standard of communication in their own work.

OTOBO Migration at TU Clausthal from OTRS 6

Pia Cebic — Thu, 02 Apr 2026 08:17:27 +0000

CASE STUDY | Enterprise-Service-Management

Digital sovereignty, full data control and a siginficantly reduced workload: Clausthal University of Technology adopts OTOBO

Introduction: 2021
Users: approx. 80 active agents, including 35–40 based in the data centre
Ticket volume: up to 10 years of historical data migrated; currently around 1,500 tickets per month
Areas of use: IT, administration, institutes, facility management, library

Digital sovereignty, full data control and a clear reduction in team workload: following the end of life of OTRS 6, the data centre at Clausthal University of Technology chose OTOBO as a powerful open-source solution – benefiting from a smooth rollout, a familiar interface, and noticeably improved collaboration.

Starting point: a proven system reaches its limits

For around 15 years, Clausthal University of Technology relied on OTRS as its central ticketing system – both within the data centre and across administrative IT, facility management, and various institutes. However, growing performance bottlenecks, OTRS’s shift towards a cloud-first model, and the restriction of key features to the commercial edition led the university to begin searching for a successor in 2021.

The aim was to find a solution that could migrate all existing data, operate without a mandatory cloud setup, offer fair licensing terms, and remain technically future-proof.

“We had a huge amount of historical data in the system – we didn’t want to lose any of it. On top of that, the cloud model would have meant paying extra for many additional features, and the agent-based licensing would have driven up costs quickly,” recalls Martin Diedrich, Head of the IT Systems Department.

Choosing OTOBO: familiar, open and flexible

After evaluating several alternatives – including Znuny, Zammad, ServiceNow, TOPdesk and Zendesk – the team chose OTOBO, an open-source fork with an active community and a clear long-term roadmap.

OTOBO stood out for its well-balanced overall package:

Familiar usability – no additional training required for agents
Complete data migration – including all messages, relationships and users
No licensing fees – no agent-based pricing, no hidden costs or add-ons, and a test system included in the service agreement
Full control – open-source foundation, no cloud requirement and no vendor lock-in
Communication on equal footing

Equally important was the openness to collaboration:

“The direct communication and pragmatic mindset throughout the project really won us over,” says Diedrich.

Smooth migration: straightforward from the outset

The migration of all data from OTRS 6 – including messages, customer relationships and user assignments – was completed quickly and without complications.

“As soon as the decision was made to go with OTOBO, I was completely at ease,” recalls the IT specialist. “There was absolutely no question that the migration would be straightforward.”

After just one day of downtime, the system was successfully transitioned. The prepared TU Clausthal design package with logo and CI was activated, and agents found themselves working in a familiar interface with well-known menus and navigation.

Even minor technical issues – such as a duplicate trigger in ticket notification events – were resolved quickly through close collaboration.

“This is where the benefits of open collaboration with the developers really show: the debugging was excellent – huge credit to the team,” Diedrich adds.

Broad adoption: from IT to facility management

Today, OTOBO is used across a wide range of departments at Clausthal University of Technology:

Around 80 active agents use OTOBO as a single point of contact (SPOC) to deliver IT support, handle requests related to lecture hall technology and recordings, and manage typical infrastructure incidents. In addition, they coordinate the central IT hardware procurement, and services such as maintenance work, cleaning, electrical work, carpentry, and hazardous materials storage.

Working with OTOBO: More structure, quicker solutions

Despite the familiar interface, OTOBO has opened up new possibilities for Clausthal University of Technology. In a review workshop following the migration, several adjustments were implemented that have noticeably eased day-to-day operations:

In addition to the hotline and email, tickets can now be created and viewed via the customer portal, which features a completely redesigned interface.

“That was very well received.”

A revised role concept ensures clearly defined responsibilities. Individually configured queues separate different areas of responsibility, while additional statuses – such as “Review needed” – help structure workflows and improve visibility when feedback is delayed.

Services and SLAs have replaced the previous prioritisation model, leading to more reliable processing times. Escalation mechanisms automatically flag tickets at risk of exceeding deadlines.

“The Escalation View is a huge help in day-to-day work. You can immediately see when a ticket has been sitting too long – for example, if a colleague forgot to hand something over before going on holiday. It’s incredibly practical,” adds Diedrich.

Internal knowledge sharing has also improved with OTOBO: response templates provide standardised answers to recurring requests and support consistent communication. Specific solutions are documented directly within tickets, while more complex technical topics and operational procedures are recorded in the FAQ module. Because this information is centrally available and accessible to everyone, agents can find the right answers more quickly – “a significant added value”.

Martin Diedrich estimates that using a central ticketing system as a shared tool has reduced time spent by at least 50 per cent, largely thanks to the increased transparency of processes. This is particularly evident in cases that do not run smoothly, as all relevant information is consistently available within the ticket for everyone involved. In quality and complaint management, the ticket history also ensures full traceability of processes over time.

Outlook and recommendation

Even at its current stage, Clausthal University of Technology demonstrates how a public university with limited resources can successfully build and run a modern, high-performance service platform – without compromising on digital sovereignty or usability.

Looking ahead, Diedrich and his colleagues have plenty of ideas for further development. As is often the case, time is the main limiting factor: further automation of processes using the workflow engine, expanding ITSM and asset management capabilities, and introducing a Kanban board to simplify dispatching are all on the agenda.

Diedrich’s recommendation to other institutions:

“Test, test, test. Think early about plugins, SLAs and automation – that’s where the real value lies. And don’t be afraid of escalations: it’s not about blame and shame. Escalations are simply a ticket’s way of making itself visible so that someone can take care of it.”

Looking to switch to OTOBO?
No problem – with us by your side, everything runs smoothly.

We take care of every step and ensure your transition is secure and straightforward.

Let’s get started

OTOBO

OTOBO 11.1.0 Beta2

OTOBO 11.1.0 (Beta2) – Security Patch

Security Fixes

Changes

Bugfixes

Enhancements

Next steps

Update to OTOBO 11.1.0 Beta2

OTOBO 11.1 Beta

OTOBO 11.0.17

OTOBO 11.0.17 – Security Patch

Security Fixes

Changes

Bugfixes

Enhancements

Next steps

Update to OTOBO 11.0.17

OTOBO 11.0

OTOBO 10.1.18

OTOBO 10.1.18 – Security Patch

Security Fixes

Changes

Bugfixes

Next steps

Update to OTOBO 10.1.18

OTOBO 10.1

OTOBO 11.1 Beta

OTOBO 11.1 (Beta)

What’s new in OTOBO 11.1 (Beta)

Ticket Handling – Better Overview, Faster Results

Process Management – Model with Precision, Control with Confidence

Dynamic Fields – Information Precisely Where Needed

Security – Modern Authentication, Secure Connectivity

Data Exchange and Integration – Significantly Simplified

Technical Notes

Changes

Enhancements

Next steps

Update, Upgrade, or Questions? We’re here.

Perl Developer | Fullstack

Perl Developer | Fullstack (m/f/d)

Your role

What we’re looking for

How we work together

Who we are

Sounds interesting? Apply now!

Open Kernel – OTOBO Enterprise Partner in Hungary

Open Kernel – New OTOBO Enterprise Partner in Central and Eastern Europe

New Chapter for Former OTRS Hungary Team

Open-Source Commitment and Active Contribution

Strengthening the OTOBO Partner Network

OTOBO 11.0.16

OTOBO 11.0.16 – Security Patch

Security Fixes

Enhancements

Changes

Bugfixes

Next steps

Update to OTOBO 11.0.16

OTOBO 11.0

OTOBO 10.1.17

OTOBO 10.1.17 – Security Patch

Security Fixes

Enhancements

Bug Fixes

Next steps

Update to OTOBO 10.1.17

OTOBO 10.1 Change Log

Security patch? System update? No need to handle it alone.

Open Kernel, Hungary

Open Kernel

OTOBO Migration at TU Clausthal from OTRS 6

Digital sovereignty, full data control and a siginficantly reduced workload: Clausthal University of Technology adopts OTOBO

Starting point: a proven system reaches its limits

Choosing OTOBO: familiar, open and flexible

Smooth migration: straightforward from the outset

Broad adoption: from IT to facility management

Working with OTOBO: More structure, quicker solutions

Diedrich estimates that the use of the central ticketing system has reduced time spent by at least 50 per cent.

Update, Upgrade, or Questions?
We’re here.

Security patch? System update?
No need to handle it alone.

Looking to switch to OTOBO?
No problem – with us by your side, everything runs smoothly.