CVE-2026-8194
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
osTicket up to version 1.18.3 has a Cross-Site Request Forgery (CSRF) vulnerability in the file include/class.dispatcher.php within the Dispatcher component. Manipulation of the _method argument leads to CSRF. Remote exploitation is possible, and the exploit has been publicly disclosed. The project was informed but has not reacted.
Risk Assessment
An attacker can perform unauthorized actions on behalf of an administrator, such as changing ticket system configuration, potentially leading to data integrity compromise.
Recommendation
Apply a temporary workaround, such as restricting access to class.dispatcher.php, or monitor osTicket updates for an official patch.
Original NVD description (English source)
A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.