CVE-2026-8194 Details
Description
A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
A cross-site request forgery (CSRF) vulnerability has been identified in osTicket versions through 1.18.3. The issue arises in the Dispatcher component, specifically within the file 'include/class.dispatcher.php'. The vulnerability allows remote exploitation by manipulating the '_method' argument, bypassing CSRF protections and enabling unauthorized actions on behalf of authenticated users.
The vulnerability can be fixed by changing the method override in 'include/class.dispatcher.php' to only accept '_method' from POST bodies instead of GET parameters. This adjustment ensures that the override is covered by the existing CSRF protection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 9, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/az10b/security-advisories/blob/main/csrf_bypass_osTicket.md | [email protected] | AdvisoryExploitRemedy |
| https://github.com/osTicket/osTicket/ | [email protected] | Vendor |
| https://github.com/osTicket/osTicket/pull/6945 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/submit/802755 | [email protected] | Permission Required |
| https://vuldb.com/vuln/362346 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/362346/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osTicket | <= 1.18.3 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | New CVE Received | [email protected] |