CVE-2026-102374: Gestsup

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.

Affected products

• Gestsup Gestsup: before 3.2.62 (fixed in 3.2.62)

Published 2026-09-29. Last modified 2026-09-30.