The vulnerability resides in the Dispatcher component of osTicket, where manipulating the ‘_method’ argument in class.dispatcher.php can trigger a cross‑site request forgery. An attacker can remotely send a crafted request that causes the application to perform an unintended state change or operation on behalf of an authenticated user. This results in a breach of user session integrity and permission boundaries, corresponding to CWE‑352 and CWE‑862 weaknesses. No denial of service or data disclosure impacts are reported, but the primary concern is unauthorized action execution by a victim.

osTicket versions up to 1.18.3 are affected. The product is the open‑source ticketing system osTicket – any deployment running a version of the codebase before the fix of pull request #6945 is vulnerable.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, but the vulnerability was disclosed publicly and the exploit has been described, suggesting it is likely usable by attackers. The issue is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending a forged HTTP request to an authenticated session; no special hardware or advanced skills are required beyond standard web request crafting.