CVE-2026-124025 · Package
NO FIX YET
Faveo Helpdesk through 2.0.3 does not check a ticket's department or assignment when rendering its PDF. An authenticated agent can request any ticket by id and get full conversation threads from other departments.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations that run a self-hosted Faveo Helpdesk install with several departments or agent roles. The attacker must already hold an agent account, and tickets for other departments are exposed through the print and PDF thread endpoints. Single-department installs with only trusted agents face little practical risk.
Not affected if single-department, trusted-agents-only
Who cares faveo-helpdesk, php, self-hosted
2.0.3 or earlier.GET /ticket/print/{id} for tickets outside their own department or assignment.No fix yet, per the sources.
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.