An improper input validation flaw in the database layer module of OTRS or its Community Edition allows an attacker to inject arbitrary SQL without needing authentication. The vulnerability is rooted in CWE‑20 and, when exploited, can bypass the authentication mechanism of the application, granting an attacker unauthorized access and the ability to manipulate data or execute further commands.

The flaw affects multiple OTRS releases, specifically 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and all 2026.X builds prior to 2026.4.X, as well as the Community Edition version 6.0.x. Products derived from the Community Edition are also highly likely to be impacted. The vulnerability is only present when the underlying MySQL or MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.

The CVSS score of 9.1 indicates a High severity level. No EPSS score is currently available, so the probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, yet the path to exploitation is straightforward: an unauthenticated user can send a crafted request that is processed by the database layer, resulting in arbitrary SQL execution and authentication bypass. Provided the database runs with NO_BACKSLASH_ESCAPES, attackers can exploit the flaw remotely via the web interface.