The vulnerability is an improper neutralization of user‑controllable input, classified as CWE-79 and CWE-116. An authenticated agent can craft request parameters that inject malicious JavaScript into URLs tied to ticket actions. When a user opens such a URL, the script runs with the privileges of the authenticated session, allowing arbitrary code execution, data exfiltration, and potential defacement within the OTRS application.

The issue affects OTRS Community Edition 7.0.x and earlier, including 6.x and prior releases of ((OTRS)) Community Edition, as well as products based on that edition. These versions are vulnerable to reflected XSS when ticket action URLs are manipulated by an authenticated user.

The CVSS score of 7.1 indicates a high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated as an agent, and the exploitation occurs when a crafted URL is opened by the victim. Because the attacker needs valid credentials, the likelihood of a large‑scale attack is lower than for unauthenticated vulnerabilities, but the impact on any compromised agent account can be substantial. The lack of a publicly known exploit does not negate the risk of manual or automated exploitation through crafted links.