{"id":"CVE-2026-111676","kind":"vulnerability","aliases":["CVE-2026-111676"],"related":[],"title":"Faveo Helpdesk: authenticated agents can read tickets from other departments","description":"Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.","summary":"Faveo Helpdesk through 2.0.3 has a broken access control flaw in its getTooltip handler, so any logged-in agent can read tickets belonging to other departments. An attacker who holds an agent account can enumerate sequential ticket IDs on GET /ticket/tooltip and read conversations, customer personal data and internal agent notes.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["faveo-helpdesk","other","php","self-hosted"],"not_affected_if":["managed-hosting","no-agent-accounts","single-department"],"how_to_check":"- Check the installed Faveo Helpdesk version and whether it is `2.0.3` or earlier\n- Review web server logs for repeated requests to `/ticket/tooltip` with sequential `ticketid` values from a single agent account","fix":null,"status":"open","published_at":"2026-10-16T18:17:50+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:05+00:00","updated_at":"2026-10-25T04:27:05+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:27:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Faveo Helpdesk: authenticated agents can read tickets from other departments","impact":"medium","summary":"Faveo Helpdesk through 2.0.3 has a broken access control flaw in its getTooltip handler, so any logged-in agent can read tickets belonging to other departments. An attacker who holds an agent account can enumerate sequential ticket IDs on GET /ticket/tooltip and read conversations, customer personal data and internal agent notes.","category":"other","nicknames":[],"who_cares":["faveo-helpdesk","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Agent reads customer personal data and internal notes from other departments","analyst_note":"Find the vendor's patched version after 2.0.3 and confirm whether the fix is in a release, since the sources give no fix version.","how_to_check":"- Check the installed Faveo Helpdesk version and whether it is `2.0.3` or earlier\n- Review web server logs for repeated requests to `/ticket/tooltip` with sequential `ticketid` values from a single agent account","needs_analyst":true,"not_affected_if":["managed-hosting","single-department","no-agent-accounts"],"who_is_affected":"Self-hosted Faveo Helpdesk installs at version 2.0.3 or earlier with multiple agent accounts spread across departments. Exposure depends on agents in one department being able to reach tickets owned by another; a single-department install has less to lose. Teams on a hosted Faveo service should wait for the vendor's notice.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3332,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111676':13A,16A '-2026':12A,15A '/ticket/tooltip':66B,109C '2.0.3':28B,80C 'access':32B,84C 'account':58B 'agent':4A,44B,57B,75B,90C,120C 'allow':88C 'attack':53B,101C 'authent':3A,89C 'belong':48B 'broken':31B,83C 'contain':81C 'control':33B,85C 'convers':69B,113C 'custom':70B,115C 'cve':11A,14A 'data':72B,117C 'depart':10A,51B,96C 'enumer':60B,103C 'faveo':1A,18B,25B,77C 'faveo-helpdesk':17B 'flaw':34B 'get':65B,108C 'gettooltip':37B,99C 'handler':38B,100C 'helpdesk':2A,19B,26B,78C 'hold':55B 'host':24B 'id':63B 'includ':114C 'intern':74B,119C 'log':42B 'logged-in':41B 'note':76B,121C 'person':71B,116C 'php':21B 'read':6A,46B,68B,92C,111C 'self':23B 'self-host':22B 'sequenti':61B,104C 'ticket':7A,47B,62B,93C,112C 'ticketid':105C 'valu':106C 'via':97C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Faveo Helpdesk installs at version 2.0.3 or earlier with multiple agent accounts spread across departments. Exposure depends on agents in one department being able to reach tickets owned by another; a single-department install has less to lose. Teams on a hosted Faveo service should wait for the vendor's notice.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111676","severity":null,"published_at":"2026-10-16T18:17:50+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}