CVE-2026-102373
Received Received - Intake

Authenticated Comment Enumeration in GestSup Before 3.2.62

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102373
EUVD
EUVD-2026-88597

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gestsup gestsup to 3.2.62 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GestSup versions before 3.2.62 have a flaw where ticket ownership is not properly validated when loading comments through the threadedit parameter in thread.php. This allows authenticated attackers to guess sequential comment IDs and read private comments from other users' tickets without authorization.

Detection Guidance

To detect this vulnerability, check if your GestSup instance is running a version before 3.2.62. You can verify the version by inspecting the application's version file or through the admin interface. Additionally, monitor network traffic for requests to thread.php with the threadedit parameter and sequential comment IDs.

Impact Analysis

If you use GestSup versions before 3.2.62, an attacker with valid login credentials could access sensitive private comments in tickets belonging to other users. This could lead to unauthorized disclosure of confidential information.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by allowing unauthorized access to private user data. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Immediately upgrade GestSup to version 3.2.62 or later to address the vulnerability. Ensure proper authorization checks are implemented for comment access. Review and restrict access to thread.php and related endpoints to prevent unauthorized enumeration of comment IDs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart