CVE-2026-124025 Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticketprint and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/id to render PDFs of other...

CVE-2026-124025

Faveo Helpdesk versions through 2.0.3 are affected by a broken access control vulnerability in the TicketController::ticket_print and pdfThread endpoints. The root cause is a failure to verify the ticket department or assignment during request processing. This allows authenticated agents to perfo...

EUVD-2026-118433

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticketprint and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/id to render PDFs of other...