{"id":"CVE-2026-115973","kind":"vulnerability","aliases":["CVE-2026-115973"],"related":[],"title":"Faveo Helpdesk 2.0.3: weak password recovery flaw in reset controller","description":"A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.","summary":"Faveo Helpdesk 2.0.3 builds its own password reset instead of using Laravel's PasswordBroker. Per the researcher, reset tokens are stored in plaintext, have no expiry, and are not deleted after use, so a token leaked once (mail logs, browser history, forwarded email) stays a working account-takeover credential. The attacker needs a leaked token, not a way to guess one. Tested only by calling the controllers directly in a local install; the vendor has not published a fix or advisory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"faveo-helpdesk","fixed":[],"affected":"2.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["faveo-helpdesk","laravel","other","password-reset","php","self-hosted"],"not_affected_if":[],"how_to_check":"Run Faveo Helpdesk 2.0.3 (check the version in the admin panel or in the release tag you deployed)? Look at app/Http/Controllers/Auth/PasswordController.php: if reset() compares the token as a plain string, never checks password_resets.created_at, and never deletes the row after use, you are exposed. Also: SELECT count(*) FROM password_resets; any old rows are still usable tokens.","fix":"unknown: no fixed Faveo version published; v2.0.3 is the latest release listed. Workaround until a patch: clear the password_resets table (TRUNCATE password_resets) now and on a schedule, restrict /password/email and /password/reset at the proxy or WAF, and patch the controllers to use Laravel's PasswordBroker or add expiry and delete-on-use. Watch github.com/faveosuite/faveo-helpdesk/releases.","status":"open","published_at":"2026-10-24T19:17:04+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","triaged_at":"2026-10-25T03:14:47+00:00","updated_at":"2026-10-25T03:16:16+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:14:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Faveo Helpdesk 2.0.3: weak password recovery flaw in reset controller","impact":"high","summary":"Faveo Helpdesk 2.0.3 has a weak password recovery flaw in its ForgotPasswordController and PasswordController reset code. The sources do not describe what an attacker gets beyond the weak recovery, but the attack can be started remotely.","category":"other","nicknames":[],"who_cares":["faveo-helpdesk","self-hosted","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Weak password recovery; sources do not describe attacker outcome.","analyst_note":"Check the NVD entry and the vendor for a fixed Faveo version and a check step; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Installations of FaveoSuite Faveo Helpdesk 2.0.3 are affected, per the sources. The affected code is app/Http/Controllers/Auth/ForgotPasswordController.php. The sources do not say which configurations or roles are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001121,"input_tokens":3357,"output_tokens":1570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor for a fixed Faveo version and a check step; the sources give neither.","search":"'-115973':13A,16A '-2026':12A,15A '2.0.3':3A,34B,122C 'account':79B 'account-takeov':78B 'advisori':113B 'affect':123C 'app/http/controllers/auth/forgotpasswordcontroller.php':136C 'attack':83B,145C 'browser':71B 'build':35B 'call':97B 'contact':153C 'control':10A,99B 'credenti':81B 'cve':11A,14A 'delet':61B 'direct':100B 'disclosur':157C 'earli':154C 'email':74B 'expiri':57B 'faveo':1A,18A,21B,32B,120C 'faveo-helpdesk':17A,20B 'faveosuit':119C 'file':135C 'fix':111B 'flaw':7A 'forgotpasswordcontrol':130C 'forward':73B 'function':129C 'guess':92B 'helpdesk':2A,19A,22B,33B,121C 'histori':72B 'host':31B 'identifi':117C 'initi':148C 'instal':104B 'instead':40B 'issu':126C 'laravel':23B,43B 'lead':139C 'leak':67B,86B 'local':103B 'log':70B 'mail':69B 'manipul':138C 'may':146C 'need':84B 'one':93B 'password':5A,26B,38B,142C 'password-reset':25B 'passwordbrok':45B 'per':46B 'php':28B 'plaintext':54B 'publish':109B 'recoveri':6A,143C 'remot':149C 'research':48B 'reset':9A,27B,39B,49B,132C 'self':30B 'self-host':29B 'sendresetlinkemail/passwordcontroller':131C 'stay':75B 'store':52B 'takeov':80B 'test':94B 'token':50B,66B,87B 'use':42B,63B 'vendor':106B,151C 'vulner':115C 'way':90B 'weak':4A,141C 'work':77B","nicknames":[],"mitigations":[],"who_affected":"Installations of FaveoSuite Faveo Helpdesk 2.0.3 are affected, per the sources. The affected code is app/Http/Controllers/Auth/ForgotPasswordController.php. The sources do not say which configurations or roles are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T19:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115973","severity":null,"published_at":"2026-10-24T19:17:04+00:00","modified_at":"2026-10-24T19:17:04+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115973:682","url":null,"severity":null,"published_at":"2026-10-25T03:16:16+00:00","modified_at":"2026-10-25T03:16:16+00:00","first_seen_at":"2026-10-25T03:16:16+00:00","fetched_at":"2026-10-25T03:16:16+00:00","note":"No vendor advisory or fixed version found (releases page lists v2.0.3 as latest; CVE record lists only 2.0.3 affected). Detail from the researcher's VulDB submission #986184: reset tokens are stored in plaintext, never expire, and are not deleted after use. Not marked verified: no vendor text. Severity left as is (CVSS 4.0 is 6.9, 3.1 is 7.3). No PoC, no exploitation seen."}],"documents":[{"id":3090,"url":"https://vuldb.com/submit/986184","title":"VulDB Submit #986184: Faveo Helpdesk 2.0.3 weak password recovery (researcher report)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3091,"url":"https://github.com/ladybirdweb/faveo-helpdesk/releases","title":"Faveo Helpdesk releases (latest listed v2.0.3)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3092,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115973","title":"CVE Record CVE-2026-115973","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}