Skip to content
OpenAdvisories

Vendor

osTicket

9 known vulnerabilities.

Products

osticket/osticket 7 osTicket 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-14871 Public exploit

    osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

    osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.

    osTicket osTicket
  • Medium 6.4
    CVE-2026-36214 Public exploit

    osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerabl…

    osTicket osTicket