GestSup EUVD-2026-88597

Requires a valid authenticated GestSup account of any privilege level (PR:L) with network access to the web application; no user interaction and no special or non-default configuration is needed. Exploitation targets the threadedit parameter of thread.php, which loads ticket comments without validating that the requesting user owns the ticket, so an attacker simply iterates sequential comment IDs. The limiting factors are the authentication requirement (self-service or granted account needed) and the read-only nature of the flaw - it discloses private comment content but cannot modify data or affect availability. All GestSup versions before 3.2.62 are affected; upgrading to 3.2.62 removes the exposure.

This is a CWE-639 insecure-direct-object-reference (IDOR) authorization flaw in GestSup's ticket comment loader. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and is internally consistent with the description: network-reachable, low complexity, requires an authenticated low-privilege account (PR:L), no user interaction, and a confidentiality-only impact (VC:H) with no integrity or availability effect. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced - so this is 'no public exploit identified at time of analysis,' NOT active exploitation. The realistic risk is moderate rather than urgent: the confidentiality impact can be high (private comments across all tickets are readable by any authenticated user via trivial sequential ID enumeration), but exploitation is gated behind holding a valid account, the impact is read-only, and the affected product has a limited deployment footprint. A patch is available from the vendor (v3.2.62), which materially lowers the priority for organizations that can update. Note the input Tag 'Authentication Bypass' conflicts with the CVSS PR:L metric - this is a post-authentication authorization/IDOR issue, not an authentication bypass; treat the tag as mislabeled.

A low-privileged authenticated GestSup user (e.g. a standard helpdesk requester) sends requests to thread.php varying the threadedit parameter across sequential comment IDs. Because ticket ownership is never validated, the server returns private comments belonging to other users' tickets, letting the attacker harvest confidential ticket discussions. No public proof-of-concept is referenced, though the VulnCheck advisory documents the technique.