CVE-2026-102373

MediumCVSS 6.5/10Last modified Oct 1, 2026

Description

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Oct 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1023746.1GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-enco CVE-2026-1023756.5Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels CVE-2026-1023767.1Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.CVE-2026-1023778.8Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.CVE-2026-1023787.1Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.CVE-2026-1023798.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder CVE-2026-1023815.3Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Secur CVE-2026-1023824.3Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Conf CVE-2026-1023836.5Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Level CVE-2026-1023845.9Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.CVE-2026-1023857.1Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-1023866.5Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.