CVE-2026-102373

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62

Description Authenticated attackers can read private comments from tickets belonging to other users without proper authorization. This occurs because the application fails to validate ticket ownership when loading comments through the 'thread.php' endpoint using the threadedit parameter. This flaw allows for the enumeration of sequential comment IDs to access unauthorized data.

Recommendations Update GestSup to version 3.2.62 or later. As a temporary mitigation, restrict access to the 'thread.php' endpoint or avoid using the threadedit parameter until the update is applied.