CVE-2026-103079: Authorization Bypass Through User-Controlled Key in Ahmad JS Help Desk

This vulnerability in Ahmad JS Help Desk (js-support-ticket) allows an attacker with some privileges to bypass authorization controls by exploiting improperly configured access control security levels via a user-controlled key. The issue affects versions from initial release through 4.0.0. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and limited confidentiality and integrity impact. No vendor advisory or patch information is available at this time.

An attacker with some level of privileges can bypass authorization controls, potentially gaining access to resources or actions normally restricted. The impact is limited to confidentiality and integrity with no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations to prevent unauthorized privilege escalation through user-controlled keys.