Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-14871

osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Fluid Attacks

Description

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

osTicket osTicket

Default version status: unaffected

  • v1.18.3affected
  • v1.17.7affected

References