HIGH 7.1 NVD
CVE-2026-102373
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can e
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.
References
- https://gestsup.fr/index.php?page=changelog
- https://gestsup.fr/index.php?page=download
- https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.62&type=patch
- https://www.vulncheck.com/advisories/gestsup-before-3.2.62-private-ticket-comment-disclosu
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-09-29 via NVD.
vulnfeed aggregates 10239 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.