Security Advisory
CVE-2026-14871
N/A
UNKNOWN
Vulnerability Description
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
Published Date
July 17, 2026
Official Source
NIST NVD Advisory