Read the docs
TI-2026-80093 Aliases CVE-2026-115972

Missing authorization in FaveoSuite Faveo Helpdesk controller

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

FaveoSuite Faveo Helpdesk up to 2.0.3 is affected. The UnAuthController actions in the helpdesk client controller lack authorization checks (CWE-862), so requests bypass access control. A remote attacker without privileges or user interaction can modify data they are not authorized to change, with a low integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FaveoSuiteFaveo Helpdesk2.0.0; 2.0.1; 2.0.2; 2.0.3—No fix listedCNA
  • Faveo Helpdesk VendorFaveoSuite Affected 2.0.0; 2.0.1; 2.0.2; 2.0.3 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:faveosuite:faveo_helpdesk:*:*:*:*:*:*:*:*——FaveoSuite
  • cpe:2.3:a:faveosuite:faveo_helpdesk:*:*:*:*:*:*:*:* Versions — — ·FaveoSuite

Remediation

The sources list no fixed version for Faveo Helpdesk.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-24 Threatist record created from CVE-2026-115972
  2. 2026-10-25 Priority changed: MEDIUM → LOW
  3. 2026-10-29 CISA SSVC decision points changed

References

—

  • TI-2026-80095 Weak password recovery in FaveoSuite Faveo Helpdesk CVSS 4.0MEDIUM 6.9
  • TI-2026-86085 Broken access control in Faveo Helpdesk exposes other departments' tickets CVSS 4.0MEDIUM 5.3
  • TI-2026-75462 Faveo Helpdesk lets agents read tickets in other departments CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences