CVE-2026-26895

27th percentile - higher than 27% of all known CVEs

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.

The risk is that an attacker can compile a list of valid user accounts, facilitating brute-force or social engineering attacks against the system.

It is recommended to update osTicket to the latest version and implement response delay mechanisms for password reset requests to hinder enumeration.