CVE-2026-14871 osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure
Attackers can view ticket fields from other departments due to missing authorization checks in the AJAX subsystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14871?
CVE-2026-14871 is a high-severity missing authorization vulnerability in osTicket, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
Weakness: CWE-863
Which versions are affected by CVE-2026-14871?
How do I fix CVE-2026-14871?
No fix has been published for CVE-2026-14871 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-14871 being exploited?
There is no known exploitation of CVE-2026-14871 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-7x96-96qf-4vq9.