Which versions of osTicket are affected by CVE-2026-14871?

osTicket versions 1.18.3 and 1.17.7 contain an authorization flaw that allows authenticated users with low-level access to view support tickets outside their authorized scope, exposing sensitive…. A patch is available.

How to fix or mitigate CVE-2026-14871?

Within 24 hours, inventory all osTicket deployments and identify which systems run versions 1.18.3 or 1.17.7, prioritizing instances containing sensitive customer data. Within 7 days, apply the vendor-released patch by upgrading to osTicket v1.18.4 (for 1.18.x deployments) or v1.17.8 (for 1.17.x deployments), validating the upgrade in a test environment first. Within 30 days, audit access logs for evidence of unauthorized cross-ticket access, notify affected customers and security teams if unauthorized access is confirmed, and implement a patch management process to track all osTicket instances and remediate future vulnerabilities promptly.

osTicket CVE-2026-14871

Q: What is the CVSS score of CVE-2026-14871?

CVE-2026-14871 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45186 HIGH

Incorrect Authorization (CWE-863)

2026-07-17 Fluid Attacks

GHSA-7x96-96qf-4vq9

Authentication Bypass Osticket

7.1

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable AJAX endpoint with low complexity, requires a valid low-privilege account (PR:L), unauthorized ticket read gives high confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 17, 2026 - 16:00 vuln.today

Analysis Generated

Jul 17, 2026 - 16:00 vuln.today

CVE Published

Jul 17, 2026 - 14:55 cve.org

HIGH 7.1

DescriptionCVE.org

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.

AnalysisAI

Unauthorized ticket data disclosure in osTicket v1.18.3 and v1.17.7 allows an authenticated low-privilege user to access tickets belonging to other users by manipulating object identifiers in the AJAX ticket-management endpoints. The flaw stems from missing per-object authorization checks (BOLA/IDOR) rather than a coding error in the request handler. It was reported by Fluid Attacks and fixed in v1.18.4/v1.17.8; no public exploit code is identified at time of analysis, though a Medium write-up and vendor advisory describe the issue.

Technical ContextAI

osTicket is a widely used open-source PHP-based customer support and helpdesk ticketing platform (CPE cpe:2.3:a:osticket:osticket). The vulnerability lives in the AJAX ticket-management subsystem, where server-side handlers accept a ticket/object identifier supplied by the client and act on it without verifying that the requesting session actually owns or is authorized for that object. This is CWE-863 (Incorrect Authorization): the application authenticates the user but fails to enforce object-level access control, so a valid session can be pointed at another user's resource. Because the identifiers are direct references (sequential or predictable ticket IDs), the missing check collapses into a classic Insecure Direct Object Reference.

RemediationAI

Vendor-released patch: upgrade to osTicket v1.18.4 (for the 1.18.x branch) or v1.17.8 (for the 1.17.x branch), both available as tagged GitHub releases (https://github.com/osTicket/osTicket/releases/tag/v1.18.4 and https://github.com/osTicket/osTicket/releases/tag/v1.17.8); the v1.18.4 notes bundle the June 2026 security patch set. Because exploitation requires an authenticated account, an effective interim compensating control is to restrict who can obtain accounts - disable open/self-service user registration and require staff-vetted account provisioning, accepting the trade-off of higher onboarding friction. Additionally, place the helpdesk behind SSO/VPN or IP allow-listing to shrink the pool of authenticated attackers, and enable and monitor access logging on AJAX ticket endpoints to detect ID enumeration; note these controls limit exposure but do not close the underlying authorization gap, so patching remains mandatory. Review the Fluid Attacks advisory (https://fluidattacks.com/advisories/kyokai) for specifics.