EUVD-2026-120550

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...

CVE-2026-125387

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...

CVE-2026-125387: faveosuite faveo-helpdesk: Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows…

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...

CVE-2026-125387

Faveo Helpdesk versions through 2.0.3 are vulnerable to an authorization bypass in the TicketController component. This flaw allows authenticated agents to modify tickets outside their own department by referencing raw ticket IDs. Specifically, an attacker can exploit the merge-tickets , change-o...

CVE-2026-125387 Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...

PT-2026-141210

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...

CVE-2026-124025 Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticketprint and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/id to render PDFs of other...

CVE-2026-124025

Faveo Helpdesk versions through 2.0.3 are affected by a broken access control vulnerability in the TicketController::ticket_print and pdfThread endpoints. The root cause is a failure to verify the ticket department or assignment during request processing. This allows authenticated agents to perfo...

EUVD-2026-118433

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticketprint and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/id to render PDFs of other...