CVE-2026-102373CWE-639

CVE-2026-102373

Medium · published September 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-29T05:16Z
References (5)
https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/ · [email protected]https://gestsup.fr/index.php?page=changelog · [email protected]https://gestsup.fr/index.php?page=download · [email protected]https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.62&type=patch · [email protected]https://www.vulncheck.com/advisories/gestsup-before-3.2.62-private-ticket-comment-disclosure-via-threadedit-parameter · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 00:33Z
    GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
    cvelistv5