EUVD-2026-44946
GHSA-f4jp-mv74-fhx2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Agent-level authentication required (PR:L), network-reachable with no scope change; limited confidentiality and integrity impact on ticket assignment data, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.
AnalysisAI
Broken access control in Perfect Support Ticketing & Document Management System through version 1.7 permits authenticated Agent-level users to manipulate the Support Agent assignment field on tickets beyond their authorized scope, including adding or removing Superadmin accounts. The vulnerability stems from missing server-side authorization checks (CWE-862), allowing role-based access controls to be circumvented entirely by any Agent assigned to a ticket. A publicly available exploit exists per VulnCheck and a GitHub PoC disclosure; no CISA KEV listing is present at time of analysis.
Technical ContextAI
The affected product is Perfect Support Ticketing & Document Management System by Ultimate Fosters (CPE: cpe:2.3:a:ultimate_fosters:perfect_support_ticketing_&_document_management_system:*:*:*:*:*:*:*:*) through version 1.7. The root cause is CWE-862 (Missing Authorization) - the application either omits or insufficiently implements server-side privilege checks when processing requests to modify the Support Agent assignment field on tickets. In typical RBAC-enforced ticketing systems, modifying agent assignments is a privileged administrative operation; here, that boundary is not enforced at the server level, allowing the lower-privileged Agent role to perform actions reserved for administrators, including manipulating Superadmin account assignments.
RemediationAI
No vendor-released patched version has been identified at time of analysis. Organizations running Perfect Support Ticketing & Document Management System through version 1.7 should monitor the vendor Ultimate Fosters for a security update and consult the VulnCheck advisory at https://www.vulncheck.com/advisories/perfect-support-ticketing-system-broken-access-control-via-agent-assignment for patch release information. As a compensating control, limit Agent-level accounts exclusively to fully trusted personnel and audit the Support Agent assignment field on all tickets for unauthorized modifications. If the application supports feature-level restrictions, consider disabling the agent assignment modification capability for non-admin roles - note that this may impact legitimate ticket routing workflows. Additionally, monitor application logs for anomalous assignment changes, particularly any touching Superadmin accounts. The public PoC at https://github.com/aaronamran/CVE-Disclosures/blob/main/CVE-2026/CVE-2026-63082 should be reviewed to understand the exact request pattern to facilitate detection rule creation.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today