CVE-2026-125387 | BDVDB-2026-402631 Detail
faveosuitefaveo-helpdesk
Description#
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-639 Authorization Bypass Through User-Controlled Key
References#
- https://github.com/faveosuite/faveo-helpdesk/issues/8368
- https://github.com/faveosuite/faveo-helpdesk
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L2230-L2300
- https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1
- https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078
- https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-tampering-via-ticketcontroller
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.