---
id: "CVE-2026-115973"
kind: "vulnerability"
aliases: ["CVE-2026-115973"]
title: "Faveo Helpdesk 2.0.3: weak password recovery flaw in reset controller"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "faveo-helpdesk", "fixed": [], "affected": "2.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["faveo-helpdesk", "laravel", "other", "password-reset", "php", "self-hosted"]
not_affected_if: []
published_at: "2026-10-24T19:17:04+00:00"
first_seen_at: "2026-10-24T19:23:38+00:00"
updated_at: "2026-10-25T03:16:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115973", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:16:16+00:00"}]
---

# Faveo Helpdesk 2.0.3: weak password recovery flaw in reset controller

Faveo Helpdesk 2.0.3 builds its own password reset instead of using Laravel's PasswordBroker. Per the researcher, reset tokens are stored in plaintext, have no expiry, and are not deleted after use, so a token leaked once (mail logs, browser history, forwarded email) stays a working account-takeover credential. The attacker needs a leaked token, not a way to guess one. Tested only by calling the controllers directly in a local install; the vendor has not published a fix or advisory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:faveo-helpdesk affected 2.0.3 fixed ?

## How to check

Run Faveo Helpdesk 2.0.3 (check the version in the admin panel or in the release tag you deployed)? Look at app/Http/Controllers/Auth/PasswordController.php: if reset() compares the token as a plain string, never checks password_resets.created_at, and never deletes the row after use, you are exposed. Also: SELECT count(*) FROM password_resets; any old rows are still usable tokens.

## Fix

unknown: no fixed Faveo version published; v2.0.3 is the latest release listed. Workaround until a patch: clear the password_resets table (TRUNCATE password_resets) now and on a schedule, restrict /password/email and /password/reset at the proxy or WAF, and patch the controllers to use Laravel's PasswordBroker or add expiry and delete-on-use. Watch github.com/faveosuite/faveo-helpdesk/releases.

## Timeline

- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115973
- 2026-10-25T03:16:16+00:00 analyst — No vendor advisory or fixed version found (releases page lists v2.0.3 as latest; CVE record lists only 2.0.3 affected). Detail from the researcher's VulDB submission #986184: reset tokens are stored in plaintext, never expire, and are not deleted after use. Not marked verified: no vendor text. Severity left as is (CVSS 4.0 is 6.9, 3.1 is 7.3). No PoC, no exploitation seen.

## Documents

- [advisory] CVE Record CVE-2026-115973 https://www.cve.org/CVERecord?id=CVE-2026-115973
- [describes] VulDB Submit #986184: Faveo Helpdesk 2.0.3 weak password recovery (researcher report) https://vuldb.com/submit/986184
- [mentions] Faveo Helpdesk releases (latest listed v2.0.3) https://github.com/ladybirdweb/faveo-helpdesk/releases

## From the sources

A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_