{"id":"CVE-2026-102374","aliases":["EUVD-2026-88598","GHSA-rhv9-26qc-872f"],"status":"published","title":"GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector","description":"GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00211,"percentile":0.11405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-29T00:33:24Z","modified":"2026-09-30T17:32:07Z","products":[{"vendor":"gestsup","product":"gestsup"}],"references":[{"url":"https://gestsup.fr/index.php?page=changelog","tags":["release-notes"]},{"url":"https://gestsup.fr/index.php?page=download","tags":["product"]},{"url":"https://gestsup.fr/index.php?page=download\u0026channel=stable\u0026version=3.2.62\u0026type=patch","tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/gestsup-before-3.2.62-stored-xss-via-double-decoded-email-subject-in-oauth-imap-connector","tags":["third-party-advisory"]},{"url":"https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/","tags":["technical-description","exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102374"},{"url":"https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue"},{"url":"https://github.com/advisories/GHSA-rhv9-26qc-872f"}],"sources":{"cve":[{"id":"CVE-2026-102374","title":"GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector","description":"GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.","status":"published","published":"2026-09-29T00:33:24.255Z","modified":"2026-09-30T11:15:14.39Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-88598","description":"GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.","status":"published","published":"2026-09-29T00:33:24Z","modified":"2026-09-30T11:15:14Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:50.183381Z"}],"ghsa":[{"id":"GHSA-rhv9-26qc-872f","title":"GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP...","description":"GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.","status":"published","published":"2026-09-29T03:30:40Z","modified":"2026-09-30T12:35:14Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:35.884172Z"}],"nvd":[{"id":"CVE-2026-102374","description":"GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.","status":"published","published":"2026-09-29T01:16:44.9Z","modified":"2026-09-30T17:32:07.107Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:52.413234Z"}]}}