faveosuite vulnerabilities

Products

• faveo-helpdesk 3
• faveo helpdesk 2

Latest faveosuite CVEs

Newest publication first

1. CVE-2026-125387 Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController

   Published 2026-11-09

   Medium·CVSS 5.3 EPSS 0.20%

   Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surr...

2. CVE-2026-124025 Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print

   Published 2026-11-06

   Medium·CVSS 5.3 EPSS 0.28%

   Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to rende...

3. CVE-2026-115973 FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery

   Published 2026-10-24

   Medium·CVSS 6.9 EPSS 0.28%

   A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak pass...

4. CVE-2026-115972 FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization

   Published 2026-10-24

   Medium·CVSS 6.9 EPSS 0.28%

   A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthContr...

5. CVE-2026-111676 Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint

   Published 2026-10-16

   Medium·CVSS 5.3 EPSS 0.25%

   Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, in...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.