CVE-2025-10696
OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 3, 2025
- Updated
- Oct 6, 2025
- Reserved
- Sep 18, 2025
Description
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | Fluid Attacks |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
OpenSupportsOpenSupports |
|
References
- https://fluidattacks.com/advisories/stratovariusthird-party-advisory
- https://github.com/opensupports/opensupportsproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.