The flaw in OTRS occurs when multiple CustomerUser backends are configured, such as a database and LDAP, because the system performs the uniqueness check for customer user email addresses only within the selected backend. An authenticated user with permission to create or modify customer users can therefore create a new customer record whose email address already exists in another backend. This results in duplicate customer user records that symbolize the same communication identity. Consequently, customer‑related data or e‑mail communication may be delivered to or exposed through the wrong customer account. The vulnerability cannot be exploited by unauthenticated users; attacker must have the privilege to add or edit customers.

The affected products are OTRS Community Edition 6.x and earlier, plus OTRS GmbH Community Edition 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and 2026.X versions prior to 2026.7.X. Because product families based on the Community Edition are also likely affected, any derivative installations built upon those versions should be treated as vulnerable.

The CVSS score of 5.4 reflects moderate severity. With no EPSS data, the likelihood of compromise is unclear, but the fact that the issue is only exploitable by users already granted customer‑account creation rights means that attacker privilege escalation is required. The vulnerability is not listed in CISA's KEV catalog. The attack vector is limited to authenticated users within the system who can add or modify customer users; an attacker would need to gain such permissions either by compromising an existing privileged account or by escalating privileges within OTRS.