https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 18:00:06 +0000 https://cve.radiocsirt.org/vuln/cve-2025-10696 <p><strong>Affected:</strong> OpenSupports</p> <p>OpenSupports exposes an endpoint that allows the list of &#39;supervised users&#39; for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added &#39;supervised&#39; users. This breaks the authorization model and filters the content of other users&#39; tickets.This issue affects OpenSupports: 4.11.0.</p> <p><strong>Affected:</strong> OpenSupports</p> <p>OpenSupports exposes an endpoint that allows the list of &#39;supervised users&#39; for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added &#39;supervised&#39; users. This breaks the authorization model and filters the content of other users&#39; tickets.This issue affects OpenSupports: 4.11.0.</p> https://cve.radiocsirt.org/vuln/cve-2025-10696