Executive brief
OpenSupports, an open-source customer support ticket system, contains a security flaw that allows certain staff members to improperly modify user relationships. By exploiting this vulnerability, a low-level staff member can grant themselves or others the ability to view private support tickets belonging to different users. This could lead to the unauthorized exposure of sensitive customer data and support history.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in OpenSupports 4.11.0 within the 'supervised users' management endpoint. The application fails to validate if the requester has the authority to modify the supervision list for a specific account. An attacker with Level 1 staff privileges can send a crafted request to modify the supervision relationship of a target user. By adding themselves or others to a target's supervised list, the attacker can bypass intended access controls to view tickets belonging to those users. This issue is tracked as CWE-863 (Incorrect Authorization).
Affected products
- OpenSupports OpenSupports 4.11.0
Timeline
- 2025-10-03: disclosed: Vulnerability disclosed by Fluid Attacks
- 2025-10-03: advisory: CVE-2025-10696 published