CVE-2026-102373

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

CVE-2026-102373 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

EUVD-2026-88597

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

CVE-2026-102373 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

CVE-2026-102373

GestSup versions before 3.2.62 are vulnerable to a private ticket comment disclosure flaw due to a failure to validate ticket ownership when loading comments via the threadedit parameter in thread.php . Authenticated attackers can exploit this by enumerating sequential comment IDs to read private...

CVE-2026-102373: Authorization Bypass Through User-Controlled Key

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

PT-2026-102422

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62 Description Authenticated attackers can read private comments from tickets belonging to other users without proper authorization. This occurs because the application fails to validate ticket ownership when...