VULNERABILITY INTELLIGENCE
CVE-2026-14871
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-07-17
Last modified2026-07-17
Description
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
Weakness classification
- help@fluidattacks.com: CWE-863