CVE-2026-72554
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling access to arbitrary ticket threads including internal agent notes.
Risk Assessment
Exposure of sensitive customer data and internal notes can lead to privacy breaches and loss of trust.
Recommendation
Update Faveo Helpdesk to a version that verifies ticket ownership in the API.
Other vulnerabilities in Faveo Helpdesk
See all- CVE-2026-78435Low
Faveo Helpdesk up to version 2.0.3 contains a path traversal vulnerability in the unlink function of SettingsController.php (Logo Handler component). Manipulation of the data1 argument allows remote file deletion. The exploit has been publicly disclosed and may be used.
- CVE-2026-78434Medium
Faveo Helpdesk up to 2.0.3 has a missing authentication flaw in the post-ticket-reply endpoint (FormController::post_ticket_reply). The attack can be initiated remotely, and the exploit has been published. The project was informed but has not responded.
Original NVD description (English source)
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticated user to access arbitrary ticket threads including internal agent notes containing sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS