CVE-2026-102374: GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GestSupto a version that resolves this vulnerability.Fixed in 3.2.62
Event History
Frequently Asked Questions
Who is exposed to this issue?
GestSup deployments before 3.2.62 that use the IMAP OAuth connector and monitor mailboxes are exposed. Technician accounts are the users whose browser sessions can execute the injected JavaScript when they view affected tickets.
What does an attacker need to exploit it?
An attacker does not need to authenticate to GestSup. They need to be able to send a crafted email to a mailbox monitored by the vulnerable IMAP OAuth connector, using nested MIME encoded-words in the email subject.
Does exploitation require a technician action?
Yes. The malicious content executes when a technician views the ticket created from the crafted email. The attacker does not need privileges, but user interaction is required.
What version addresses the issue?
The issue affects versions before 3.2.62. Updating to version 3.2.62 or later addresses the affected version range described here.