CVE-2026-102373
GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 29, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 28, 2026
Description
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
GestSupGestSup |
|
References
- https://gestsup.fr/index.php?page=changelogrelease-notes
- https://gestsup.fr/index.php?page=downloadproduct
- https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.62&type=patchpatch
- VulnCheck Advisory: GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameterthird-party-advisory
- https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/technical-descriptionexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.