Which versions of osTicket are affected by CVE-2026-14871?

osTicket versions 1.18.3 and 1.17.7 contain an authorization flaw that allows authenticated users with low-level access to view support tickets outside their authorized scope, exposing sensitive…. A patch is available.

How to fix or mitigate CVE-2026-14871?

Within 24 hours, inventory all osTicket deployments and identify which systems run versions 1.18.3 or 1.17.7, prioritizing instances containing sensitive customer data. Within 7 days, apply the vendor-released patch by upgrading to osTicket v1.18.4 (for 1.18.x deployments) or v1.17.8 (for 1.17.x deployments), validating the upgrade in a test environment first. Within 30 days, audit access logs for evidence of unauthorized cross-ticket access, notify affected customers and security teams if unauthorized access is confirmed, and implement a patch management process to track all osTicket instances and remediate future vulnerabilities promptly.

osTicket CVE-2026-14871

Q: What is the CVSS score of CVE-2026-14871?

CVE-2026-14871 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-45186 HIGH

Incorrect Authorization (CWE-863)

2026-07-17 Fluid Attacks

Authentication Bypass Osticket

7.1

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable AJAX endpoint with low complexity, requires a valid low-privilege account (PR:L), unauthorized ticket read gives high confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 17, 2026 - 16:00 vuln.today

Analysis Generated

Jul 17, 2026 - 16:00 vuln.today

CVE Published

Jul 17, 2026 - 14:55 cve.org

HIGH 7.1

DescriptionCVE.org

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.

AnalysisAI

Unauthorized ticket data disclosure in osTicket v1.18.3 and v1.17.7 allows an authenticated low-privilege user to access tickets belonging to other users by manipulating object identifiers in the AJAX ticket-management endpoints. The flaw stems from missing per-object authorization checks (BOLA/IDOR) rather than a coding error in the request handler. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain authenticated osTicket account

Delivery

Open own ticket via AJAX endpoint

Exploit

Capture object identifier in request

Execution

Substitute/enumerate other ticket IDs

Persist

Retrieve unauthorized ticket contents

Impact

Exfiltrate sensitive support data