CVE-2025-24391

Possible user enumeration

State: Published
Severity: 5.3 Medium
Published: Jul 14, 2025
Updated: Jul 14, 2025
Reserved: Jan 21, 2025

Description

A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses.

This issue affects:

* OTRS 7.0.X

* OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	OTRS

Weaknesses

CWE-203 Observable Discrepancy

Affected Products

Product	Versions
OTRSOTRS AG	7.0.xAffected 8.0.xAffected 2023.xAffected 2024.xAffected 2025.x through 2025.5.xAffected

References

https://otrs.com/release-notes/otrs-security-advisory-2025-07/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.