CVE-2026-26895
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
Published Apr 2, 2026 · updated Jul 24, 2026 · enhancesoft osticket
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 2, 2026 · NIST NVD
Detected
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
Jul 24, 2026 · NIST NVD
Updated
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
Affected
- cpe enhancesoft/osticketversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-26895
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-26895
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
nvd.nist.gov