{"id":"CVE-2026-125387","kind":"vulnerability","aliases":["CVE-2026-125387"],"related":[],"title":"Faveo Helpdesk: agents can modify tickets outside their department","description":"Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.","summary":"Faveo Helpdesk through 2.0.3 lets logged-in agents reference raw ticket IDs to act on tickets in other departments. An attacker with an agent account can close, merge, reassign and read the subjects of other departments' customer tickets.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["faveo-helpdesk","other","php","self-hosted"],"not_affected_if":["no-agent-accounts","single-department-setup","version-above-2.0.3"],"how_to_check":"- Check the installed Faveo Helpdesk version against the range through `2.0.3`\n- Review whether agents from one department can reach tickets owned by another department in the TicketController endpoints (merge-tickets, change-owner, ticket/assign, ticket/surrender)","fix":null,"status":"open","published_at":"2026-11-10T00:17:12+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","triaged_at":"2026-11-10T00:30:28+00:00","updated_at":"2026-11-10T00:30:28+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:30:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Faveo Helpdesk: agents can modify tickets outside their department","impact":"medium","summary":"Faveo Helpdesk through 2.0.3 lets logged-in agents reference raw ticket IDs to act on tickets in other departments. An attacker with an agent account can close, merge, reassign and read the subjects of other departments' customer tickets.","audience":"businesses","category":"other","nicknames":[],"who_cares":["faveo-helpdesk","self-hosted","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Agent reassigns, closes or reads other departments' customer tickets","analyst_note":"Confirm the fixed version and vendor advisory; the linked patch pages on github.com and the VulnCheck advisory were not read.","how_to_check":"- Check the installed Faveo Helpdesk version against the range through `2.0.3`\n- Review whether agents from one department can reach tickets owned by another department in the TicketController endpoints (merge-tickets, change-owner, ticket/assign, ticket/surrender)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-department-setup","no-agent-accounts","version-above-2.0.3"],"who_is_affected":"Any team running Faveo Helpdesk through version 2.0.3 with more than one department and multiple agent accounts. Exposure requires an authenticated agent account; single-department or single-agent deployments are less exposed. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000749,"input_tokens":4640,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125387':12A,15A '-2026':11A,14A '2.0.3':27B,66C 'account':49B 'act':38B 'agent':3A,32B,48B,77C 'allow':75C 'attack':45B,89C 'authent':76C 'author':69C 'bypass':70C 'call':91C 'chang':96C 'change-own':95C 'close':51B,103C 'contain':67C 'custom':61B,112C 'cve':10A,13A 'depart':9A,43B,60B,83C,108C 'endpoint':101C 'enumer':111C 'faveo':1A,17B,24B,63C 'faveo-helpdesk':16B 'helpdesk':2A,18B,25B,64C 'host':23B 'id':36B,88C 'let':28B 'log':30B 'logged-in':29B 'merg':52B,93C,104C 'merge-ticket':92C 'modifi':5A,79C 'outsid':7A,81C 'owner':97C 'php':20B 'raw':34B,86C 'read':55B 'reassign':53B,106C 'refer':33B 'referenc':85C 'self':22B 'self-host':21B 'subject':57B,114C 'ticket':6A,35B,40B,62B,80C,87C,94C,109C,113C 'ticket/assign':98C 'ticket/surrender':100C 'ticketcontrol':73C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Any team running Faveo Helpdesk through version 2.0.3 with more than one department and multiple agent accounts. Exposure requires an authenticated agent account; single-department or single-agent deployments are less exposed. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["faveohelpdesk","medium","other","php","selfhosted"],"campaign_type":null,"search_a":"'-125387':12A,15A '-2026':11A,14A 'agent':3A 'cve':10A,13A 'depart':9A 'faveo':1A 'helpdesk':2A 'modifi':5A 'outsid':7A 'ticket':6A","search_b":"'2.0.3':27B 'account':49B 'act':38B 'agent':32B,48B 'attack':45B 'close':51B 'custom':61B 'depart':43B,60B 'faveo':17B,24B 'faveo-helpdesk':16B 'helpdesk':18B,25B 'host':23B 'id':36B 'let':28B 'log':30B 'logged-in':29B 'merg':52B 'php':20B 'raw':34B 'read':55B 'reassign':53B 'refer':33B 'self':22B 'self-host':21B 'subject':57B 'ticket':35B,40B,62B","search_c":"'2.0.3':66C 'agent':77C 'allow':75C 'attack':89C 'authent':76C 'author':69C 'bypass':70C 'call':91C 'chang':96C 'change-own':95C 'close':103C 'contain':67C 'custom':112C 'depart':83C,108C 'endpoint':101C 'enumer':111C 'faveo':63C 'helpdesk':64C 'id':88C 'merg':93C,104C 'merge-ticket':92C 'modifi':79C 'outsid':81C 'owner':97C 'raw':86C 'reassign':106C 'referenc':85C 'subject':114C 'ticket':80C,87C,94C,109C,113C 'ticket/assign':98C 'ticket/surrender':100C 'ticketcontrol':73C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125387","severity":null,"published_at":"2026-11-10T00:17:12+00:00","modified_at":"2026-11-10T00:17:12+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","fetched_at":"2026-11-10T00:28:43+00:00","note":null}],"documents":[{"id":111564,"url":"https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111565,"url":"https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111566,"url":"https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-tampering-via-ticketcontroller","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}