CVE-2026-26895 identifies a user enumeration vulnerability in osTicket version 1.18.2 specifically in the /pwreset.php endpoint. This vulnerability enables unauthenticated remote attackers to enumerate valid usernames registered in the system. The weakness corresponds to CWE-203 (Information Exposure Through Discrepancy). The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits in the wild or patches are currently documented.

The vulnerability allows attackers to confirm the existence of specific usernames on the osTicket platform, potentially aiding further targeted attacks such as phishing or brute force attempts. There is no direct impact on data integrity or system availability. Confidentiality is partially impacted by exposure of valid user identifiers.

No official patch or fix is currently documented for this vulnerability. Users of osTicket version 1.18.2 should monitor vendor advisories for updates. In the meantime, consider implementing additional access controls or rate limiting on the /pwreset.php endpoint to reduce enumeration risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.