{"id":"CVE-2026-115972","kind":"vulnerability","aliases":["CVE-2026-115972"],"related":[],"title":"Faveo Helpdesk: unauthenticated controller lets anyone change ticket status","description":"A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.","summary":"Faveo Helpdesk up to version 2.0.3 has a missing authorization check in its UnAuthController, which handles changeStatus, close, open and resolve actions on tickets. A remote attacker can manipulate the id and status arguments to alter helpdesk tickets without proper permission.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["faveo-helpdesk","package","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Faveo Helpdesk version in the application's configuration or release files; versions up to `2.0.3` are listed as affected\n- Inspect `app/Http/Controllers/Client/helpdesk/UnAuthController.php` for the changeStatus, close, open and resolve methods and whether they enforce authorization","fix":"- unknown; the sources do not name a fixed version or vendor patch","status":"open","published_at":"2026-10-24T18:16:48+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","triaged_at":"2026-10-25T03:38:33+00:00","updated_at":"2026-10-25T03:38:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:38:33Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources do not name a fixed version or vendor patch","reach":"internet","title":"Faveo Helpdesk: unauthenticated controller lets anyone change ticket status","impact":"medium","summary":"Faveo Helpdesk up to version 2.0.3 has a missing authorization check in its UnAuthController, which handles changeStatus, close, open and resolve actions on tickets. A remote attacker can manipulate the id and status arguments to alter helpdesk tickets without proper permission.","category":"package","nicknames":[],"who_cares":["faveo-helpdesk","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker changes ticket status without authorization","analyst_note":"Find the vendor advisory or patched Faveo Helpdesk release and confirm which routes are exposed by default; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-115972 gives no fix.","how_to_check":"- Check the installed Faveo Helpdesk version in the application's configuration or release files; versions up to `2.0.3` are listed as affected\n- Inspect `app/Http/Controllers/Client/helpdesk/UnAuthController.php` for the changeStatus, close, open and resolve methods and whether they enforce authorization","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running FaveoSuite Faveo Helpdesk version 2.0.3 or earlier that expose the client helpdesk routes served by UnAuthController to the internet. The sources do not say which default configurations expose these routes, so the exposure of any given install is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":3388,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115972':12A,15A '-2026':11A,14A '/unauthcontroller.close/unauthcontroller.open/unauthcontroller.resolve':85C '2.0.3':29B,75C 'action':45B 'affect':76C 'alter':59B 'anyon':6A 'app/http/controllers/client/helpdesk/unauthcontroller.php':89C 'argument':57B,95C 'attack':50B,103C 'author':33B,101C 'chang':7A 'changestatus':40B 'check':34B 'close':41B 'contact':111C 'control':4A 'cve':10A,13A 'determin':68C 'disclosur':115C 'earli':112C 'execut':90C 'faveo':1A,17B,24B,71C 'faveo-helpdesk':16B 'faveosuit':70C 'file':88C 'function':82C 'handl':39B 'helpdesk':2A,18B,25B,60B,72C 'host':23B 'id':54B 'id/status':96C 'launch':106C 'lead':98C 'let':5A 'manipul':52B,92C 'miss':32B,100C 'open':42B 'packag':19B 'permiss':64B 'php':20B 'proper':63B 'remot':49B,107C 'resolv':44B 'self':22B 'self-host':21B 'status':9A,56B 'ticket':8A,47B,61B 'unauthcontrol':37B 'unauthcontroller.changestatus':84C 'unauthcontroller.changestatus/unauthcontroller.close/unauthcontroller.open/unauthcontroller.resolve':83C 'unauthent':3A 'vendor':109C 'version':28B 'vulner':66C,79C 'without':62B","nicknames":[],"mitigations":[],"who_affected":"Teams running FaveoSuite Faveo Helpdesk version 2.0.3 or earlier that expose the client helpdesk routes served by UnAuthController to the internet. The sources do not say which default configurations expose these routes, so the exposure of any given install is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T18:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115972","severity":null,"published_at":"2026-10-24T18:16:48+00:00","modified_at":"2026-10-24T18:16:48+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}