VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Oct 3, 2025· Updated Jun 1, 2026

CVE-2025-10696

CVE-2025-10696

Description

OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Opensupports/Opensupports3 versions
    cpe:2.3:a:opensupports:opensupports:4.11.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:opensupports:opensupports:4.11.0:*:*:*:*:*:*:*
    • (no CPE)range: = 4.11.0
    • (no CPE)range: 4.11.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.