CVE-2026-54826: Psm Plugins Supportcandy

High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.

Affected products

• Psm Plugins Supportcandy: up to and including 3.4.6

Published 2026-06-26. Last modified 2026-06-29.