CVE-2021-36097

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.

• CWE-266

• https://otrs.com/release-notes/otrs-security-advisory-2021-20/Release Notes, Vendor Advisory
• https://otrs.com/release-notes/otrs-security-advisory-2021-20/Release Notes, Vendor Advisory

Published

Oct 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36091Agents are able to list appointments in the calendars withou…4.3
• CVE-2021-36092It's possible to create an email which contains specially cr…6.1
• CVE-2021-36093It's possible to create an email which can be stuck while be…5.3
• CVE-2021-36094It's possible to craft a request for appointment edit screen…5.4
• CVE-2021-36095Malicious attacker is able to find out valid user logins by …5.3
• CVE-2021-36096Generated Support Bundles contains private S/MIME and PGP ke…4.9
• CVE-2021-3610A heap-based buffer overflow vulnerability was found in Imag…7.5
• CVE-2021-36100Specially crafted string in OTRS system configuration can al…8.8
• CVE-2021-3611A stack overflow vulnerability was found in the Intel HD Aud…6.5
• CVE-2021-3612An out-of-bounds memory write flaw was found in the Linux ke…7.8
• CVE-2021-36121An issue was discovered in Echo ShareCare 8.15.5. The file-u…8.8
• CVE-2021-36122An issue was discovered in Echo ShareCare 8.15.5. The UnzipF…8.8