CVE-2026-102373 — GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequenti…
Published: 2026-09-29 · CVSS: 7.1 · CVSS 4.0
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7