CVE-2026-111676
MediumCVSS 4.3Summary
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.
Risk Assessment
Exposure of customer personal data and internal agent notes can lead to confidentiality breaches and GDPR compliance issues. Unauthorized access to tickets from other departments breaks departmental separation of privileges.
Recommendation
Upgrade Faveo Helpdesk beyond version 2.0.3 as soon as a fixed release is available. Until then, restrict access to the /ticket/tooltip endpoint and enforce departmental authorization checks server-side.
Other vulnerabilities in Faveo Helpdesk
See all- CVE-2026-115973High
In FaveoSuite Faveo Helpdesk 2.0.3, the ForgotPasswordController::sendResetLinkEmail/PasswordController::reset function in app/Http/Controllers/Auth/ForgotPasswordController.php leads to weak password recovery. The attack may be initiated remotely.
- CVE-2026-115972Medium
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 affecting the UnAuthController.changeStatus/close/open/resolve functions in app/Http/Controllers/Client/helpdesk/UnAuthController.php. Manipulating the id/status arguments leads to missing authorization, and the attack can be launched remotely.
- CVE-2026-78435Low
Faveo Helpdesk up to version 2.0.3 contains a path traversal vulnerability in the unlink function of SettingsController.php (Logo Handler component). Manipulation of the data1 argument allows remote file deletion. The exploit has been publicly disclosed and may be used.
- CVE-2026-78434Medium
Faveo Helpdesk up to 2.0.3 has a missing authentication flaw in the post-ticket-reply endpoint (FormController::post_ticket_reply). The attack can be initiated remotely, and the exploit has been published. The project was informed but has not responded.
- CVE-2026-72554Medium
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling access to arbitrary ticket threads including internal agent notes.
Original NVD description (English source)
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS