CVE-2026-63082 is a broken access control vulnerability in Ultimate Fosters' Perfect Support Ticketing & Document Management System through version 1.7. It allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field on tickets by bypassing intended authorization checks. This enables attackers to add or remove any user, including those with Superadmin privileges, from tickets to which they are assigned, effectively circumventing role-based access controls and potentially escalating privileges or disrupting ticket management.

The vulnerability permits authenticated Agent-level users to alter ticket assignments, including adding or removing Superadmin accounts from tickets. This bypasses intended access controls and could lead to unauthorized privilege escalation or interference with ticket handling processes. However, exploitation requires at least Agent-level authentication, limiting exposure to internal or trusted users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Agent-level privileges to trusted users only and monitor ticket assignment changes for suspicious activity. No vendor-provided patches or temporary fixes are currently documented.