CVE-2026-8194

4.3

Received

Description

A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Severity

Score 4.3

Severity MEDIUM

Timeline

Published May 09, 2026

Modified May 09, 2026

References

https://github.com/az10b/security-advisories/blob/main/csrf_bypass_osTicket.md
https://github.com/osTicket/osTicket/
https://github.com/osTicket/osTicket/pull/6945
https://vuldb.com/submit/802755
https://vuldb.com/vuln/362346
https://vuldb.com/vuln/362346/cti