6 matches found
EUVD-2026-120550
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...
CVE-2026-125387
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...
CVE-2026-125387: faveosuite faveo-helpdesk: Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows…
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...
CVE-2026-125387
Faveo Helpdesk versions through 2.0.3 are vulnerable to an authorization bypass in the TicketController component. This flaw allows authenticated agents to modify tickets outside their own department by referencing raw ticket IDs. Specifically, an attacker can exploit the merge-tickets , change-o...
CVE-2026-125387 Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...
PT-2026-141210
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...