CVE-2026-18818
Full vulnerability record from the local CVENow database.
Description
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-04 23:16:51.300000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-18818",
"sourceIdentifier": "[email protected]",
"published": "2026-08-04T23:16:51.300",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [
{
"sourceIdentifier": "[email protected]",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
},
{
"lang": "es",
"value": "Se ha identificado una debilidad en Ehco1996 django-sspanel hasta el 26.12.2023. Esto afecta a la función TicketDetailView del archivo apps/sspanel/views.py del componente Gestor de Tickets de Soporte. La ejecución de una manipulación puede llevar a una omisión de autorización. El ataque puede ejecutarse de forma remota. Se contactó al proveedor con antelación sobre esta divulgación, pero no respondió de ninguna manera. Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el mantenedor."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Ehco1996",
"product": "django-sspanel",
"cpes": [
"cpe:2.3:a:ehco1996:django-sspanel:*:*:*:*:*:*:*:*"
],
"modules": [
"Support Ticket Handler"
],
"versions": [
{
"version": "2023.12.0",
"status": "affected"
},
{
"version": "2023.12.1",
"status": "affected"
},
{
"version": "2023.12.2",
"status": "affected"
},
{
"version": "2023.12.3",
"status": "affected"
},
{
"version": "2023.12.4",
"status": "affected"
},
{
"version": "2023.12.5",
"status": "affected"
},
{
"version": "2023.12.6",
"status": "affected"
},
{
"version": "2023.12.7",
"status": "affected"
},
{
"version": "2023.12.8",
"status": "affected"
},
{
"version": "2023.12.9",
"status": "affected"
},
{
"version": "2023.12.10",
"status": "affected"
},
{
"version": "2023.12.11",
"status": "affected"
},
{
"version": "2023.12.12",
"status": "affected"
},
{
"version": "2023.12.13",
"status": "affected"
},
{
"version": "2023.12.14",
"status": "affected"
},
{
"version": "2023.12.15",
"status": "affected"
},
{
"version": "2023.12.16",
"status": "affected"
},
{
"version": "2023.12.17",
"status": "affected"
},
{
"version": "2023.12.18",
"status": "affected"
},
{
"version": "2023.12.19",
"status": "affected"
},
{
"version": "2023.12.20",
"status": "affected"
},
{
"version": "2023.12.21",
"status": "affected"
},
{
"version": "2023.12.22",
"status": "affected"
},
{
"version": "2023.12.23",
"status": "affected"
},
{
"version": "2023.12.24",
"status": "affected"
},
{
"version": "2023.12.25",
"status": "affected"
},
{
"version": "2023.12.26",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-05T17:52:20.422334Z",
"id": "CVE-2026-18818",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-285"
},
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"references": [
{
"url": "https://vuldb.com/cve/CVE-2026-18818",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/857943",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/385817",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/385817/cti",
"source": "[email protected]"
}
]
}