MEDIUM 5.3 NVD
CVE-2026-125387
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.
References
- https://github.com/faveosuite/faveo-helpdesk
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpde
- https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20
- https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e630
- https://github.com/faveosuite/faveo-helpdesk/issues/8368
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.