CVE-2026-63082: Unauthorized Modification of Ticket Support Agent Assignments in Perfect Support

Vulnerability Overview Vulnerability ID: CVE-2026-63082 Vulnerability Name: Unauthorized Modification of Ticket Support Agent Assignments Researchers: Aaron Amran Bin Amiruddin (@aaronamran), Shahrul Nizam Bin Shahrim Severity: TBD Publication Date: 2026-07-16 Software Link: Perfect Support Ticketing & Document Management System Impact Scope Description: A security vulnerability exists in the ticket assignment mechanism of Perfect Support Ticketing & Document Management System v1.7. An authenticated remote attacker with Agent-level privileges can perform unauthorized administrative operations. Once a specific support ticket is assigned to a low-privilege Agent, that Agent can arbitrarily add or remove other assigned users, including high-privilege Superadmin accounts, from the support agent field. This constitutes an access control flaw, allowing low-privilege users to modify assignment scopes defined by administrator users. Remediation Remediation Advice: No specific remediation steps are currently provided on the page. It is recommended to contact the software vendor to obtain the latest security patches or updates. Proof-of-Concept (POC) 1. Prerequisites: Ensure you have an account with Agent privileges and that an active support ticket is assigned to the target Agent (e.g., assigned by a Superadmin). Log in to the application using the account with Agent privileges. - (Ref: CVE-2026-63082_image1.png) 2. Step: Open the assigned support ticket from the Agent dashboard. 3. Step: Locate the support agent assignment field in the ticket management interface. Note that despite having low privileges, the Agent has full modification rights to this field. - (Ref: CVE-2026-63082_image2.png) 4. Step: Interact with this field to arbitrarily add or remove assigned users, including high-privilege Superadmin accounts, thereby bypassing the expected access control and privilege boundaries. Code Blocks No specific POC code or exploitation code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-63082: Unauthorized Modification of Ticket Support Agent Assignments in Perfect Support

More from this source