CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
Staff members can modify supervision lists for other users, allowing unauthorized access to and modification of ticket visibility settings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10696?
CVE-2025-10696 is a high-severity missing authorization vulnerability in OpenSupports, published on 3 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.
Weakness: CWE-863
Which versions are affected by CVE-2025-10696?
It affects 1 product.
Products include Opensupports Opensupports.
How do I fix CVE-2025-10696?
No fix has been published for CVE-2025-10696 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-10696 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10696 exists.
Other vulnerabilities in OpenSupports
Sources
Also known as GHSA-www6-qmfj-v924.