https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 13:39:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-254199 EUVD-2026-254199 https://cve.radiocsirt.org/vuln/euvd-2026-254199 https://cve.radiocsirt.org/vuln/fkie_cve-2025-10696 <p>OpenSupports exposes an endpoint that allows the list of &#39;supervised users&#39; for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added &#39;supervised&#39; users. This breaks the authorization model and filters the content of other users&#39; tickets.This issue affects OpenSupports: 4.11.0.</p> <p>OpenSupports exposes an endpoint that allows the list of &#39;supervised users&#39; for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added &#39;supervised&#39; users. This breaks the authorization model and filters the content of other users&#39; tickets.This issue affects OpenSupports: 4.11.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-10696 https://cve.radiocsirt.org/vuln/ghsa-www6-qmfj-v924 <p>OpenSupports exposes an endpoint that allows the list of &#39;supervised users&#39; for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added &#39;supervised&#39; users. This breaks the authorization model and filters the content of other users&#39; tickets.This issue affects OpenSupports: 4.11.0.</p> <p>OpenSupports exposes an endpoint that allows the list of &#39;supervised users&#39; for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added &#39;supervised&#39; users. This breaks the authorization model and filters the content of other users&#39; tickets.This issue affects OpenSupports: 4.11.0.</p> https://cve.radiocsirt.org/vuln/ghsa-www6-qmfj-v924