Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support...

zetlyn/cve-ghsa vulnerability ghsa GHSA-6f4g-xj5p-3c9x cve CVE-2026-103078 known 2026-10-05

https://github.com/advisories/GHSA-6f4g-xj5p-3c9x

Properties

cvss

cvss	4.3 receipt Source GitHub advisories Its words `4.3` Read by `field:cvss.score` Said since 2026-10-05 12:20 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "comments": 0, "credits": [], "cve_id": "CVE-2026-103078", "cvss": { "score": 4.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, "cvss_severities": { "cvss_v3": { "score": 4.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [ { "cwe_id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" } ], "description": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.", "ghsa_id": "GHSA-6f4g-xj5p-3c9x", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x", "identifiers": [ { "type": "GHSA", "value": "GHSA-6f4g-xj5p-3c9x" }, { "type": "CVE", "value": "CVE-2026-103078" } ], "nvd_published_at": "2026-10-05T09:17:06Z", "published_at": "2026-10-05T09:31:52Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-103078", "https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve", "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x" ], "repository_advisory_url": null, "severity": "medium", "source_code_location": "", "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support...", "type": "unreviewed", "updated_at": "2026-10-05T09:31:57Z", "url": "https://api.github.com/advisories/GHSA-6f4g-xj5p-3c9x", "vulnerabilities": [], "withdrawn_at": null }
cwe	CWE-639 receipt Source GitHub advisories Its words `CWE-639` Read by `field:cwes[].cwe_id` Said since 2026-10-05 12:20 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "comments": 0, "credits": [], "cve_id": "CVE-2026-103078", "cvss": { "score": 4.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, "cvss_severities": { "cvss_v3": { "score": 4.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [ { "cwe_id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" } ], "description": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.", "ghsa_id": "GHSA-6f4g-xj5p-3c9x", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x", "identifiers": [ { "type": "GHSA", "value": "GHSA-6f4g-xj5p-3c9x" }, { "type": "CVE", "value": "CVE-2026-103078" } ], "nvd_published_at": "2026-10-05T09:17:06Z", "published_at": "2026-10-05T09:31:52Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-103078", "https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve", "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x" ], "repository_advisory_url": null, "severity": "medium", "source_code_location": "", "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support...", "type": "unreviewed", "updated_at": "2026-10-05T09:31:57Z", "url": "https://api.github.com/advisories/GHSA-6f4g-xj5p-3c9x", "vulnerabilities": [], "withdrawn_at": null }
severity	medium receipt Source GitHub advisories Its words `medium` Read by `field:severity` Said since 2026-10-05 12:20 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "comments": 0, "credits": [], "cve_id": "CVE-2026-103078", "cvss": { "score": 4.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, "cvss_severities": { "cvss_v3": { "score": 4.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [ { "cwe_id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" } ], "description": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.", "ghsa_id": "GHSA-6f4g-xj5p-3c9x", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x", "identifiers": [ { "type": "GHSA", "value": "GHSA-6f4g-xj5p-3c9x" }, { "type": "CVE", "value": "CVE-2026-103078" } ], "nvd_published_at": "2026-10-05T09:17:06Z", "published_at": "2026-10-05T09:31:52Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-103078", "https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve", "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x" ], "repository_advisory_url": null, "severity": "medium", "source_code_location": "", "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support...", "type": "unreviewed", "updated_at": "2026-10-05T09:31:57Z", "url": "https://api.github.com/advisories/GHSA-6f4g-xj5p-3c9x", "vulnerabilities": [], "withdrawn_at": null }

4.3

receipt

Source: GitHub advisories
Its words: 4.3
Read by: field:cvss.score
Said since: 2026-10-05 12:20 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-103078",
  "cvss": {
    "score": 4.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 4.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-639",
      "name": "Authorization Bypass Through User-Controlled Key"
    }
  ],
  "description": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.",
  "ghsa_id": "GHSA-6f4g-xj5p-3c9x",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6f4g-xj5p-3c9x"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-103078"
    }
  ],
  "nvd_published_at": "2026-10-05T09:17:06Z",
  "published_at": "2026-10-05T09:31:52Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-103078",
    "https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve",
    "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support...",
  "type": "unreviewed",
  "updated_at": "2026-10-05T09:31:57Z",
  "url": "https://api.github.com/advisories/GHSA-6f4g-xj5p-3c9x",
  "vulnerabilities": [],
  "withdrawn_at": null
}

cwe

CWE-639

receipt

Source: GitHub advisories
Its words: CWE-639
Read by: field:cwes[].cwe_id
Said since: 2026-10-05 12:20 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-103078",
  "cvss": {
    "score": 4.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 4.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-639",
      "name": "Authorization Bypass Through User-Controlled Key"
    }
  ],
  "description": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.",
  "ghsa_id": "GHSA-6f4g-xj5p-3c9x",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6f4g-xj5p-3c9x"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-103078"
    }
  ],
  "nvd_published_at": "2026-10-05T09:17:06Z",
  "published_at": "2026-10-05T09:31:52Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-103078",
    "https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve",
    "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support...",
  "type": "unreviewed",
  "updated_at": "2026-10-05T09:31:57Z",
  "url": "https://api.github.com/advisories/GHSA-6f4g-xj5p-3c9x",
  "vulnerabilities": [],
  "withdrawn_at": null
}

severity

medium

receipt

Source: GitHub advisories
Its words: medium
Read by: field:severity
Said since: 2026-10-05 12:20 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-103078",
  "cvss": {
    "score": 4.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 4.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-639",
      "name": "Authorization Bypass Through User-Controlled Key"
    }
  ],
  "description": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.",
  "ghsa_id": "GHSA-6f4g-xj5p-3c9x",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6f4g-xj5p-3c9x"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-103078"
    }
  ],
  "nvd_published_at": "2026-10-05T09:17:06Z",
  "published_at": "2026-10-05T09:31:52Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-103078",
    "https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve",
    "https://github.com/advisories/GHSA-6f4g-xj5p-3c9x"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support...",
  "type": "unreviewed",
  "updated_at": "2026-10-05T09:31:57Z",
  "url": "https://api.github.com/advisories/GHSA-6f4g-xj5p-3c9x",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support... Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.