Medium severity6.5NVD Advisory· Published Sep 29, 2026

CVE-2026-102373

Description

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.

Patches

Vulnerability mechanics

References

gestsup.fr/index.phpnvd
gestsup.fr/index.phpnvd
gestsup.fr/index.phpnvd
www.vulncheck.com/advisories/gestsup-before-3.2.62-private-ticket-comment-disclosure-via-threadedit-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000