What is the CVSS score of CVE-2026-32535?

CVE-2026-32535 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Js Help Desk are affected by CVE-2026-32535?

CVE-2026-32535 presents notable security risk, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-32535?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Js Help Desk CVE-2026-32535

EUVD-2026-15909 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-25 Patchstack

GHSA-r3wv-xr72-34x9

WordPress Authentication Bypass Js Help Desk Wordpress Plugin Joomsky

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15909

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 3.0.3.

AnalysisAI

JS Help Desk (JoomSky) versions up to 3.0.3 contain an authorization bypass vulnerability caused by insecure direct object references (IDOR) and incorrectly configured access control security levels. An attacker with minimal or no privileges can exploit user-controlled keys in API requests or direct object references to access, modify, or view unauthorized help desk tickets, user data, and support resources. While no CVSS score is currently assigned and KEV/EPSS data are unavailable, the vulnerability has been publicly reported by Patchstack with reference documentation available.

Technical ContextAI

The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaw where an application uses user-supplied input to directly reference resources without proper authorization verification. In JS Help Desk (cpE: cpe:2.3:a:joomsky:js_help_desk:*:*:*:*:*:*:*:*), the affected component likely exposes object identifiers (ticket IDs, user IDs, or support queue references) as parameters that are not properly validated against the requesting user's access control list. This is compounded by incorrectly configured access control security levels that fail to enforce role-based or permission-based restrictions on resource access. The vulnerability affects the core authorization layer of the help desk application rather than a specific third-party library.

RemediationAI

Upgrade JS Help Desk to a version greater than 3.0.3 where the authorization bypass has been remediated; consult the vendor security advisory and release notes at https://patchstack.com/database/Wordpress/Plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-3-0-3-insecure-direct-object-references-idor-vulnerability for specific patched versions. As an interim measure, enforce strict role-based access control (RBAC) policies by auditing and tightening security levels within the application's access control configuration, restricting API endpoints to authenticated users only, and implementing rate limiting and request validation on ticket and resource access endpoints. Monitor help desk activity logs for suspicious patterns of unauthorized resource access or enumeration attempts.