osTicket BOLA/IDOR Vulnerability in Ticket Field Viewing Allows Cross-Department Data Disclosure

osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure Vulnerability Overview osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) vulnerability in the AJAX ticket management subsystem ( ). The method, when retrieving ticket fields, only checks if the requested field exists but does not verify whether the authenticated user has permission to access the department to which the ticket belongs. Consequently, a low-privilege agent assigned to a single department can request fields belonging to tickets in other departments. Affected Endpoint: Root Cause: The method lacks an authorization boundary check derived from the request path. The method retrieves the ticket represented by and parses the requested , then returns the field data without invoking to verify permissions. Impact Scope Affected Product: osTicket Affected Versions: v1.18.3 - v1.17.7 CVSS v4.0 Base Score: 7.1 (High) Remote Exploitable: Yes Exploit Code: Yes CVE ID: CVE-2026-14871 Remediation Upgrade to a patched version: v1.18.4 v1.17.8 Proof of Concept (PoC) The following script demonstrates how to exploit this vulnerability. Prerequisites: A vulnerable osTicket instance. Two isolated departments (e.g., and ). A low-privilege agent assigned only to . A ticket in containing a field that the agent has no permission to view. Note: The ticket ID referenced in the exploit should ideally belong to the target department to demonstrate the cross-access, but the logic implies accessing a field from a ticket outside the agent's scope. Correction based on context: The PoC assumes accessing a ticket/field that the user shouldn't have access to. Let's stick to the original text's structure: A ticket in (this phrasing is slightly ambiguous in the source, usually it means a ticket belonging to Dept-A). Let's translate faithfully: A ticket belonging to with ID (likely a placeholder name) containing a field that the agent cannot view. Reproduction Steps: 1. Configure with the osTicket base URL, agent credentials, and the target ticket and field IDs. 2. Run the script: 3. The script authenticates at , retrieves the CSRF token, and sends the following request: 4. On affected versions, the server responds with HTTP 200 and returns the restricted field data. On patched versions, the same cross-department request will return HTTP 403. This PoC can also enumerate a small set of field IDs after confirming an initial unauthorized read. ```

Goal Reached Thanks to every supporter — we hit 100%!

osTicket BOLA/IDOR Vulnerability in Ticket Field Viewing Allows Cross-Department Data Disclosure