CVE-2026-102373 in GestSup
Summary
by MITRE • 09/29/2026
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in GestSup prior to version 3.2.62 represents a critical failure in access control mechanisms, specifically manifesting as an insecure direct object reference within the application's ticket management module. The core technical flaw resides in the thread.php script, which processes requests via the threadedit parameter to load comment data associated with support tickets. In this implementation, the system fails to validate whether the authenticated user initiating the request is the legitimate owner of the specific ticket or has been explicitly granted permission to view its contents. Instead of verifying ownership against a session-based access control list or database record linking users to tickets, the application relies solely on the sequential nature of comment identifiers provided in the request payload. This architectural oversight allows any authenticated user to manipulate the input parameters and traverse through different ticket comments by incrementing or decrementing the identifier values.
From an operational perspective, this flaw enables unauthorized data disclosure and information enumeration attacks. An attacker who has obtained valid credentials for a low-privilege account can systematically iterate through sequential comment IDs to access private communications intended for other users. This capability effectively bypasses the application's role-based access controls, allowing sensitive internal discussions, customer details, or troubleshooting steps contained within those comments to be exfiltrated. The impact extends beyond simple data leakage; it compromises the integrity of the support workflow by exposing confidential operational strategies and potentially violating regulatory compliance requirements regarding data privacy and confidentiality, such as GDPR or HIPAA if personal health information is involved in the tickets.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-284, which describes Improper Access Control, specifically falling under the sub-category of Insecure Direct Object Reference where object identifiers are used without sufficient authorization checks. Furthermore, from a tactical perspective within the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie if session hijacking is combined with ID enumeration, though primarily it represents an unauthorized data access vector often categorized under initial exploitation or lateral movement depending on the broader context of the breach. The lack of server-side validation for object ownership means that even authenticated users can escalate their effective privileges regarding specific resources without needing higher system-level permissions.
To mitigate this vulnerability, immediate patching to version 3.2.62 or later is required as it addresses these access control deficiencies. In environments where upgrading is not immediately feasible, a compensating control involves implementing strict server-side validation logic that verifies the relationship between the authenticated user's identity and the requested ticket ID before rendering any comment data. Developers should ensure that all database queries include explicit checks confirming that the current session owner matches the assigned agent or customer of the target ticket. Additionally, adopting non-sequential identifiers for internal resources can reduce the efficiency of enumeration attacks, although this is a secondary defense since proper authorization logic must remain the primary safeguard against such access control failures.