GestSup EUVD-2026-88596

Requires that the GestSup instance has the IMAP LOGIN email connector enabled and configured to poll a mailbox reachable by the attacker (a monitored support inbox) - this is the specific feature that turns inbound email into ticket content. Delivery itself needs no authentication and no special attacker privileges; the attacker only needs to know or guess the monitored email address. Exploitation is LIMITED by requiring victim interaction (UI:P): a technician must actually open the malicious ticket/reply in their browser for the payload to fire, and impact is confined to the technician's authenticated session (ticket data theft, actions-as-technician) rather than direct server compromise. Environments not using the IMAP LOGIN connector are not exposed via this vector.

This is a moderate-priority, real-but-bounded issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 5.3 and indicates a network-reachable, low-complexity flaw requiring no attacker authentication - the injection is delivered simply by emailing the monitored IMAP mailbox, which is a genuinely low bar. The counterweight is impact and interaction: the vector assigns no impact to the primary vulnerable system (VC:N/VI:N/VA:N) and only low confidentiality/integrity to the subsequent system (SC:L/SI:L) - i.e. the payload only executes in a technician's browser (UI:P/passive interaction), not on the GestSup server itself, so this is classic stored XSS rather than server compromise. No EPSS score, KEV listing, POC, or SSVC decision data is provided, so exploitation-probability and automatability signals are absent - this should be read as 'no public exploit identified at time of analysis,' NOT as low real risk. The signals are internally consistent (network reachable, unauthenticated delivery, victim-side execution, limited impact) with no contradictions to flag. A patch (3.2.62) is confirmed available from the vendor, which raises actionability. Net: patch it, but it is not a drop-everything critical.

An attacker with no credentials sends an email to the support mailbox that GestSup polls via its IMAP LOGIN connector, embedding a <script> tag or an event-handler attribute (e.g. onerror) in the HTML body. GestSup ingests the body unsanitized into a new ticket description or reply, and when a helpdesk technician later opens that ticket in their browser the JavaScript runs in the GestSup application origin, enabling theft of ticket data or actions performed as the technician. No public exploit code is identified at time of analysis, though the technique is trivially reproducible.