CVE-2025-10696
OpenSupports 4.11.0
- Class
- IDOR
- Severity
- High · CVSS 4.0 score 7.1
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- stratovarius
- Affected
- OpenSupports 4.11.0
The defect
IDOR (supervised list, cross-user ticket disclosure)
Class overview · IDOR
An object reference is trusted without checking that the requester may see that object. Anyone who can obtain another user's identifier gets that user's data through their own session.