Medium severity · published Aug 4, 2026
CVE-2026-18818
Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DJ
django-sspanel · Ehco1996
2023.12.0; 2023.12.1; 2023.12.2; 2023.12.3; 2023.12.4; 2023.12.5; +21 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18818
vuldb.com
https://vuldb.com/cve/CVE-2026-18818
vuldb.com
https://vuldb.com/submit/857943
vuldb.com
https://vuldb.com/vuln/385817
vuldb.com
https://vuldb.com/vuln/385817/cti
More from django-sspanel
9.8
CVE-2023-38941
django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._post