This vulnerability arises from improper input validation in the database layer of OTRS and ((OTRS)) Community Edition, enabling unauthenticated SQL injection attacks that can bypass authentication controls. The issue is conditional on the MySQL/MariaDB server being configured with the NO_BACKSLASH_ESCAPES SQL mode, which alters how escape characters are processed. Affected versions include OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x prior to 2026.4.x, as well as ((OTRS)) Community Edition 6.0.x. Products derived from ((OTRS)) Community Edition are also likely vulnerable. No official remediation or patch has been documented in the vendor advisory or CVE data.

Successful exploitation allows an unauthenticated attacker to perform SQL injection, potentially bypassing authentication mechanisms. This can lead to unauthorized access with high confidentiality and integrity impact, but no direct availability impact is noted. The vulnerability is critical due to the ease of network access (no privileges or user interaction required) and the high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review their MySQL/MariaDB server configurations, particularly the NO_BACKSLASH_ESCAPES SQL mode, as this mode is a prerequisite for exploitation. Consider disabling this SQL mode if feasible and monitor vendor communications for updates. No official patches or temporary fixes have been announced at this time.