Authorization Bypass in OpenSupports Affects User Privacy

CVE-2025-10696

What is CVE-2025-10696?

OpenSupports contains a vulnerability that allows unauthorized modification of 'supervised users' for any account due to inadequate validation. As a result, a Level 1 staff member can alter the supervision relationships of other users, potentially revealing confidential ticket information to individuals who should not have access. This flaw undermines the system's authorization model, leading to compromised user privacy and security across the platform.

References