The vulnerability allows an attacker to impersonate any existing OTRS user by sending a crafted Remote-User HTTP header. The application reads this header into the HTTP_REMOTE_USER environment variable and, when HTTP Basic Authentication is configured, trusts it as an already authenticated username without performing password verification. This grants the attacker the same privileges as the impersonated agent or customer, giving access to confidential information and the ability to modify data or configuration, as described in the official advisory.

OTRS GmbH Community Edition 6 and earlier, including OTRS 6.x. Products based on the Community Edition are also likely affected. Version 7 and later are not vulnerable due to changes in the underlying framework and removal of the insecure environment variable handling.

The CVSS score of 9.4 indicates a critical level of risk. The EPSS score is not available, but the vulnerability can be exploited over the network from any system that can send HTTP requests to the affected server. Because it requires HTTP Basic Authentication backend configuration and a web server that maps request headers into environment variables (common in CGI or mod_perl deployments), exploitation is relatively straightforward for attackers with internet exposure. The vulnerability is not listed in the CISA KEV catalog, but the severity and attack vector justify urgent remediation.