CVE-2023-33706: SysAid

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp.

Affected products

• SysAid SysAid: before 23.2.15 (fixed in 23.2.15); before 23.2.50 (fixed in 23.2.50)

Published 2023-11-24. Last modified 2026-06-17.