A AegiFlow
MEDIUMCVSS 5.3

CVE-2026-26895

CVE-2026-26895 updated by NVD

Modified
2026-07-26
Sources
nvd

Summary

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.

References

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.