Live › vulnerability › CVE-2026-115972
Go to dashboardFaveo Helpdesk up to version 2.0.3 has a missing authorization check in its UnAuthController, which handles changeStatus, close, open and resolve actions on tickets. A remote attacker can manipulate the id and status arguments to alter helpdesk tickets without proper permission.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:53 UTC. All times on this page are UTC.
Teams running FaveoSuite Faveo Helpdesk version 2.0.3 or earlier that expose the client helpdesk routes served by UnAuthController to the internet. The sources do not say which default configurations expose these routes, so the exposure of any given install is unknown.
No product ranges from the sources yet.
2.0.3 are listed as affectedapp/Http/Controllers/Client/helpdesk/UnAuthController.php for the changeStatus, close, open and resolve methods and whether they enforce authorizationEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-115972")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.