The vulnerability allows attackers to determine which usernames are registered on an osTicket installation by sending web requests to the password‑reset page. This user enumeration can be used to gather contact information that supports social engineering or credential‑based attacks. The weakness is classified as CWE‑203, where information that should remain confidential is inadvertently disclosed.

vulnerable to this flaw are products running osTicket version 1.18.2. No other vendors or product lineages are listed as affected, so the impact is limited to installations of this specific version.

The CVSS score of 5.3 indicates a moderate severity. While the EPSS score is unavailable and the flaw is not listed in CISA’s KEV catalog, the attack path is inferred to be remote over the network, triggered by HTTP requests to /pwreset.php. Due to the lack of documented exploitation and moderate score, the overall risk is moderate, but addressing it promptly is advisable.