TI-2026-86085 Aliases CVE-2026-124025 GHSA-p5r3-pjjx-rggv

Broken access control in Faveo Helpdesk exposes other departments' tickets

LOW 24CWE-639Published 2026-11-06 · Updated 2026-11-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Faveo Helpdesk through 2.0.3 contains a broken access control flaw in TicketController::ticket_print and the pdfThread endpoint that does not check a ticket's department or assignment. An authenticated agent can request arbitrary ticket ids to render PDFs of other departments' tickets, including full conversation threads (CWE-639). The CVSS 4.0 base score is 5.3 (medium).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.

Why it matters now

EPSS 0.00277 20th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FaveoSuite	faveo-helpdesk	up to 2.0.3	—	No fix listed	CNA

faveo-helpdesk VendorFaveoSuite Affected up to 2.0.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Faveo Helpdesk.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

2026-11-06 Threatist record created from CVE-2026-124025
2026-11-06 Alias added: GHSA-p5r3-pjjx-rggv

References

Patch 1

https://github.com/faveosuite/faveo-helpdesk/commit/408076c7fa921133920decceec306b194affdcee

Other 4

TI-2026-80095 Weak password recovery in FaveoSuite Faveo Helpdesk CVSS 4.0MEDIUM 6.9
TI-2026-80093 Missing authorization in FaveoSuite Faveo Helpdesk controller CVSS 4.0MEDIUM 6.9
TI-2026-75462 Faveo Helpdesk lets agents read tickets in other departments CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences