EUVD-2025-32431Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.
AnalysisAI
Vertical privilege escalation in OpenSupports 4.11.0 allows a Level 1 staff member to edit supervised user lists of any account, enabling unauthorized access to ticket content of other users. The vulnerability has publicly available proof-of-concept exploit code, but no active exploitation in the wild has been reported. EPSS probability is low at 0.04%.
More in Opensupports
View allOpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated critical severity (CVSS 9.8
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied d
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today