CVE-2023-38058

What it actually does

Missing authorization check in the ticket move action permits any authenticated agent user to relocate tickets regardless of assigned permissions.

Why it matters to the business

Ticket ownership and queue assignments can be altered by unauthorized staff, leading to workflow disruption, delayed responses, and potential mishandling of customer requests.

How an attack unfolds

An attacker logs into the agent interface with valid credentials, crafts a ticket-move HTTP request targeting a ticket they lack rights to move, and submits it; the server performs the move because the permission check is absent.

How to fix it

Upgrade OTRS to version 8.0.35 or later; review and tighten agent role permissions after upgrade.

How to confirm the fix worked

Confirm the installed OTRS version is 8.0.35 or newer; attempt a ticket move with an account that lacks the required permission and verify the action is now blocked.

Typical attack path

1. Obtain valid agent credentials
2. Identify a ticket the account is not permitted to move
3. Issue a ticket move request via the agent web interface or API
4. Observe successful relocation of the ticket

How to detect it

Review web-server and application logs for ticket-move requests issued by agents whose roles do not include the move permission; correlate with ticket history showing unexpected queue changes.

What your security team should do

• Apply the 8.0.35 update immediately across all instances
• Audit existing agent permissions for least-privilege compliance
• Enable detailed logging of ticket move operations for ongoing monitoring