Vulnerability Description
A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/az10b/security-advisories/blob/main/csrf_bypass_osTicket.md
- https://github.com/osTicket/osTicket/
- https://github.com/osTicket/osTicket/pull/6945
- https://vuldb.com/submit/802755
- https://vuldb.com/vuln/362346
- https://vuldb.com/vuln/362346/cti
FAQ
What is CVE-2026-8194?
CVE-2026-8194 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argum...
How severe is CVE-2026-8194?
CVE-2026-8194 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-8194?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.