CVE-2026-57652
MediumCVSS 5.3Summary
An IDOR vulnerability in JS Help Desk versions up to 3.1.0 allows an unauthenticated attacker to directly access objects such as tickets or customer data by manipulating request parameters.
Risk Assessment
The risk involves unauthorized reading, modification, or deletion of sensitive helpdesk data without authentication, potentially leading to information disclosure and confidentiality breaches.
Recommendation
It is recommended to immediately upgrade JS Help Desk to a version newer than 3.1.0 and implement authorization and access validation mechanisms for objects.
Other vulnerabilities in JS Help Desk <= 3.1.0
See all- CVE-2026-56054High
In JS Help Desk versions <= 3.1.1, there is a vulnerability that allows subscribers to delete arbitrary files.
- CVE-2026-48886Critical
JS Help Desk versions up to 3.0.9 are vulnerable to unauthenticated SQL injection, potentially allowing attackers to access database data.
- CVE-2026-15209Medium
The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
- CVE-2026-14931Medium
The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
- CVE-2026-48887Medium
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.