CVE-2026-102373: GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GestSupto a version that resolves this vulnerability.Fixed in 3.2.62
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to GestSup and have the ability to request thread.php with the threadedit parameter. No user interaction is required.
What information can be exposed?
The issue allows reading private comments associated with other users' tickets. Confidentiality is affected; the provided data does not indicate integrity or availability impact.
How is the issue exploited in practice?
An authenticated attacker can enumerate sequential comment IDs through the threadedit parameter. The affected versions do not validate ticket ownership when loading those comments.
Which versions should be remediated?
GestSup versions before 3.2.62 are affected. Version 3.2.62 is identified in the available references as the stable patch version.