CVE-2026-63082— Perfect Support Ticketing System 1.7 Broken Access Control via Agent Assignment
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Ultimate Fosters | Perfect Support Ticketing & Document Management System | ≤ 1.7 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63082
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Perfect Support Ticketing System 1.7 Broken Access Control via Agent Assignment
Source: NVD (National Vulnerability Database)
Vulnerability Description
Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Ultimate Fosters Perfect Support Ticketing & Document Management System 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ultimate Fosters Perfect Support Ticketing & Document Management System是Ultimate Fosters公司的一款工单与文档管理系统。 Ultimate Fosters Perfect Support Ticketing & Document Management System 1.7及之前版本存在授权问题漏洞，该漏洞源于访问控制不当，可能导致经过身份验证的攻击者绕过授权检查，操纵票证的Support Agent分配字段，添加或删除包
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ultimate Fosters | Perfect Support Ticketing & Document Management System | 0 ~ 1.7 | - |
II. Public POCs for CVE-2026-63082
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63082
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-63082 (1)
News Coverage for CVE-2026-63082 (1)
- 🔗 CVE-Disclosures/CVE-2026/CVE-2026-63082 at main · aaronamran/CVE-Disclosures · GitHub Read full article technical-descriptionexploit
IV. Related Vulnerabilities
Same weakness: CWE-862
- CVE-2026-16215
geex-arts django-jet OAuth Credential Revoke authorization - CVE-2026-16197
Sipeed PicoClaw Group Message feishu_64.go handleMessageRece - CVE-2026-16123
nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go Tool - CVE-2026-45704
Pimcore: CustomReports Share Bypass - CVE-2026-45260
Pimcore: Missing Authorization in WebDAV MOVE via unchecked
V. Comments for CVE-2026-63082
No comments yet