Vulnerability · Published Oct 3, 2025 · Assigned by Fluid Attacks

CVE-2025-10696OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list

High 7.1

In plain English

A high-severity incorrect authorization in OpenSupports from OpenSupports. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.

Affected products (as reported)

Vendor	Product	Versions
OpenSupports	OpenSupports	4.11.0

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://fluidattacks.com/advisories/stratovarius third-party-advisory
https://github.com/opensupports/opensupports product