CVE-2025-10692: Opensupports

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, effectively bypassing department scoping and disclosing tickets beyond their intended access.This issue affects OpenSupports: 4.11.0.

Affected products

• Opensupports Opensupports: version 4.11.0 only

Published 2025-10-03. Last modified 2026-06-17.