CVE-2026-102373

GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.

Affected

GestSup

CVSS v4.0 VULNCHECK

7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-09-29

Updated

2026-10-01

Proof-of-concept exploits (2)

• https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/
• SpiizN/cves1★ · 2026-10-08

References

• CVE Record
• NVD entry

Related

• CVE-2026-100389
• CVE-2026-102372
• CVE-2026-102374