Medium severity · published Sep 29, 2026
CVE-2026-102373
GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GestSup · GestSup
before 3.2.62 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102373
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102373
release-notes
https://gestsup.fr/index.php?page=changelog
product
https://gestsup.fr/index.php?page=download
patch
https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.62&type=patch
third-party-advisory
https://www.vulncheck.com/advisories/gestsup-before-3.2.62-private-ticket-comment-disclosure-via-threadedit-parameter
technical-description
https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/
More from GestSup
9.8
CVE-2021-31646
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote)
8.8
CVE-2026-22194
GestSup <= 3.2.60 CSRF Allows Privileged Actions
8.1
CVE-2026-100389
GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
8.1
CVE-2026-22196
GestSup < 3.2.60 SQL Injection in Ticket Creation
8.1
CVE-2026-22197
GestSup < 3.2.60 Multiple SQL Injections in Asset List