What is the CVSS score of CVE-2026-26895?

CVE-2026-26895 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-26895

EUVD-2026-18366 MEDIUM

Observable Discrepancy (CWE-203)

2026-04-02 mitre

GHSA-6p2p-wf8c-wq75

PHP Information Disclosure N A

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 02, 2026 - 17:00 euvd

EUVD-2026-18366

Analysis Generated

Apr 02, 2026 - 17:00 vuln.today

CVE Published

Apr 02, 2026 - 00:00 nvd

MEDIUM 5.3

DescriptionCVE.org

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.

AnalysisAI

User enumeration in osTicket v1.18.2's password reset endpoint (/pwreset.php) enables remote attackers to discover valid usernames through response analysis, facilitating targeted account compromise attempts. No CVSS score, CISA KEV status, or confirmed patch information is available; exploitation likelihood depends on whether timing or behavioral differences between valid and invalid usernames can be reliably detected without authentication.

Technical ContextAI

The vulnerability resides in the password reset functionality of osTicket, a PHP-based open-source help desk ticketing system. The /pwreset.php endpoint fails to implement consistent response behavior when processing password reset requests for both existent and non-existent usernames. This information disclosure flaw (CWE class not specified in available data) allows unauthenticated attackers to profile valid user accounts by submitting username queries and observing differential responses-typically timing delays, HTTP status codes, or error message variations that leak whether a username exists in the system. The vulnerability is particularly concerning in help desk environments where username enumeration can be combined with credential stuffing or brute-force attacks targeting known valid accounts.

RemediationAI

Patch availability for CVE-2026-26895 is not confirmed in available data. Users should (1) check osTicket's official security advisories at osticket.com for v1.18.2+ patch releases addressing /pwreset.php enumeration, (2) apply the latest stable version if a formal patch exists, or (3) implement rate limiting and consistent response timing on the /pwreset.php endpoint to prevent timing-based enumeration as an interim control. Organizations unable to patch immediately should monitor password reset request logs for bulk enumeration attempts and consider implementing CAPTCHA or multi-step verification on the reset flow to raise attack friction. Reference csacyber.com blog post for technical details on timing-vulnerability exploitation mechanics.