CVE-2026-48887
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to a loss of confidentiality.
Recommendation
It is recommended to upgrade to the latest version of JS Help Desk to mitigate this security vulnerability.
Other vulnerabilities in JS Help Desk
See all- CVE-2026-57652Medium
An IDOR vulnerability in JS Help Desk versions up to 3.1.0 allows an unauthenticated attacker to directly access objects such as tickets or customer data by manipulating request parameters.
- CVE-2026-56054High
In JS Help Desk versions <= 3.1.1, there is a vulnerability that allows subscribers to delete arbitrary files.
- CVE-2026-48886Critical
JS Help Desk versions up to 3.0.9 are vulnerable to unauthenticated SQL injection, potentially allowing attackers to access database data.
- CVE-2026-15209Medium
The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
- CVE-2026-14931Medium
The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Original NVD description (English source)
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.