CVE-2026-63082

MediumCVSS 5.4

Published: 16/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A broken access control vulnerability in Perfect Support Ticketing & Document Management System through version 1.7 allows authenticated attackers with Agent-level privileges to bypass authorization checks and manipulate the Support Agent assignment field of tickets. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket they are assigned to.

Risk Assessment

The risk involves privilege escalation and unauthorized access to sensitive tickets, potentially leading to data leakage or disruption of business processes.

Recommendation

Immediately update the system to the latest version and implement access control patches for the agent assignment field.

Other vulnerabilities in Perfect Support Ticketing & Document Management System

CVE-2026-63081Medium
Perfect Support Ticketing & Document Management System through version 1.7 contains a stored cross-site scripting vulnerability. Authenticated attackers with Agent-level privileges can inject malicious payloads into the Notes field of assigned support tickets, which execute in the browser context of any user viewing those notes, including Superadmin users.

Original NVD description (English source)

Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS