From https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/, released today:

An attacker can send a specially prepared email to an OTRS system. If this system has cookie support disabled, and a logged in agent clicks a link in this email, the session information could be leaked to external systems, allowing the attacker to take over the agent’s session.

Let's upgrade to 5.0.26 which has been released already.