{"id":"CVE-2026-124025","kind":"vulnerability","aliases":["CVE-2026-124025"],"related":[],"title":"Faveo Helpdesk: agents can print tickets from other departments","description":"Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.","summary":"Faveo Helpdesk through 2.0.3 does not check a ticket's department or assignment when rendering its PDF. An authenticated agent can request any ticket by id and get full conversation threads from other departments.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["faveo-helpdesk","package","php","self-hosted"],"not_affected_if":["single-department","trusted-agents-only"],"how_to_check":"- Confirm whether your instance runs Faveo Helpdesk and which version is installed, looking for a version string of `2.0.3` or earlier.\n- Check whether agents can reach `GET /ticket/print/{id}` for tickets outside their own department or assignment.","fix":null,"status":"open","published_at":"2026-11-06T20:17:20+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:22+00:00","updated_at":"2026-11-06T20:44:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T20:44:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Faveo Helpdesk: agents can print tickets from other departments","impact":"medium","summary":"Faveo Helpdesk through 2.0.3 does not check a ticket's department or assignment when rendering its PDF. An authenticated agent can request any ticket by id and get full conversation threads from other departments.","audience":"businesses","category":"package","nicknames":[],"who_cares":["faveo-helpdesk","self-hosted","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated agent reads other departments' ticket conversations as PDFs","analyst_note":"Check the Patch and Release notes links for the fixed version and whether the fix is in a release after 2.0.3.","how_to_check":"- Confirm whether your instance runs Faveo Helpdesk and which version is installed, looking for a version string of `2.0.3` or earlier.\n- Check whether agents can reach `GET /ticket/print/{id}` for tickets outside their own department or assignment.","plain_action":"","needs_analyst":true,"not_affected_if":["single-department","trusted-agents-only"],"who_is_affected":"Organisations that run a self-hosted Faveo Helpdesk install with several departments or agent roles. The attacker must already hold an agent account, and tickets for other departments are exposed through the print and PDF thread endpoints. Single-department installs with only trusted agents face little practical risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4301,"output_tokens":547,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124025':12A,15A '-2026':11A,14A '/ticket/print':93C '2.0.3':27B,61C 'access':65C 'agent':3A,43B,85C 'arbitrari':88C 'assign':36B,83C 'authent':42B,84C 'broken':64C 'check':30B 'contain':62C 'control':66C 'convers':53B,104C 'cve':10A,13A 'depart':9A,34B,57B,81C,100C 'endpoint':75C 'fail':77C 'faveo':1A,17B,24B,58C 'faveo-helpdesk':16B 'full':52B,103C 'get':51B,92C 'helpdesk':2A,18B,25B,59C 'host':23B 'id':49B,90C,94C 'includ':102C 'packag':19B 'pdf':40B 'pdfs':97C 'pdfthread':74C 'php':20B 'print':5A,71C 'render':38B,96C 'request':45B,87C 'self':22B 'self-host':21B 'thread':54B,105C 'ticket':6A,32B,47B,70C,80C,89C,101C 'ticketcontrol':69C 'verifi':79C 'via':91C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Organisations that run a self-hosted Faveo Helpdesk install with several departments or agent roles. The attacker must already hold an agent account, and tickets for other departments are exposed through the print and PDF thread endpoints. Single-department installs with only trusted agents face little practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["faveohelpdesk","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-124025':12A,15A '-2026':11A,14A 'agent':3A 'cve':10A,13A 'depart':9A 'faveo':1A 'helpdesk':2A 'print':5A 'ticket':6A","search_b":"'2.0.3':27B 'agent':43B 'assign':36B 'authent':42B 'check':30B 'convers':53B 'depart':34B,57B 'faveo':17B,24B 'faveo-helpdesk':16B 'full':52B 'get':51B 'helpdesk':18B,25B 'host':23B 'id':49B 'packag':19B 'pdf':40B 'php':20B 'render':38B 'request':45B 'self':22B 'self-host':21B 'thread':54B 'ticket':32B,47B","search_c":"'/ticket/print':93C '2.0.3':61C 'access':65C 'agent':85C 'arbitrari':88C 'assign':83C 'authent':84C 'broken':64C 'contain':62C 'control':66C 'convers':104C 'depart':81C,100C 'endpoint':75C 'fail':77C 'faveo':58C 'full':103C 'get':92C 'helpdesk':59C 'id':90C,94C 'includ':102C 'pdfs':97C 'pdfthread':74C 'print':71C 'render':96C 'request':87C 'thread':105C 'ticket':70C,80C,89C,101C 'ticketcontrol':69C 'verifi':79C 'via':91C 'vulner':67C","first_public_at":"2026-11-06T20:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124025","severity":null,"published_at":"2026-11-06T20:17:20+00:00","modified_at":"2026-11-06T20:17:20+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null}],"documents":[{"id":89768,"url":"https://github.com/faveosuite/faveo-helpdesk/commit/408076c7fa921133920decceec306b194affdcee","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89769,"url":"https://github.com/faveosuite/faveo-helpdesk/releases/tag/v2.0.4.RC.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":89770,"url":"https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-disclosure-via-ticket-print","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}