Vision Helpdesk versions prior to 5.7.0 contain a flaw that lets attackers modify a serialized cookie named vis_client_id to read user profile data. The vulnerability is an information disclosure weakness that can be exploited by sending crafted requests to the web interface, enabling unauthorized access to sensitive user information. The weakness falls under CWE-425.

The affected product is Vision:Helpdesk. Versions before 5.7.0 are vulnerable, and the issue was addressed in patch release 5.6.10. Therefore any deployment of Vision:Helpdesk earlier than 5.6.10, including 5.6.0 through 5.6.9 and earlier releases, is at risk.

The CVSS Base score of 4.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Attackers can exploit the flaw remotely by manipulating the vis_client_id cookie, so the threat is remote. To mitigate, the vendor recommends upgrading to version 5.6.10 or newer.