Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
CVE-2026-14871 CVE-2026-14871 - BOLA / IDOR in osTicket http://ajax.tickets.php Broken Object Level Authorization (BOLA) https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-14871
Post summary
The text announces CVE-2026-14871 as a Broken Object Level Authorization (BOLA/IDOR) vulnerability in osTicket.
Hey folks, I recently posted the bug I found in OsTicket with CVE-2026-14871 🙌 https://medium.com/@juanfelipeoz.rar/how-i-found-an-authorization-bug-in-osticket-ajax-controller-1abb8be847e6
Post summary
The author announced they have discovered an authorization bug in osTicket (CVE‑2026‑14871) and posted a Medium article about it, but no exploit code, active exploitation, or patch information is provided.
A zero-day vulnerability in osTicket was discovered by an external pentester, then reviewed and documented by Fluid Attacks: ID CVE-2026-14871. You can find the full details here: 🔗 https://fluidattacks.com/advisories/kyokai. We have disclosed 276 #CVE to this date: 🔗https://fluidattacks.com/advisories. https://t.co/BIY8tdMxAO
Post summary
Fluid Attacks announces the discovery and documentation of a zero-day vulnerability in osTicket (CVE-2026-14871) and directs readers to their advisory for full details.