CVE-2026-26895

osTicket version 1.18.2 is susceptible to a user enumeration vulnerability within the /pwreset.php file. This flaw allows remote attackers to identify and enumerate valid usernames registered on the platform. No specific remediation or exploit links are provided in the documents.