Vision Helpdesk versions prior to 5.7.0, specifically patched in 5.6.10, contain a CWE-425 direct request vulnerability where attackers can manipulate serialized cookie data (vis_client_id) to access unauthorized user profiles. The CVSS 3.1 score is 4.3 (medium), reflecting network attack vector, low complexity, and limited confidentiality impact without affecting integrity or availability. No official remediation level or patch link is provided in the data, but the description notes the issue is patched in version 5.6.10.

An attacker with some level of privileges can read user profile information by modifying cookie data, potentially exposing sensitive user information. There is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Upgrade Vision Helpdesk to version 5.6.10 or later, where this vulnerability is patched. Since the vendor advisory confirms the fix in 5.6.10, applying this update is the recommended remediation. No additional mitigation steps are indicated.