---
id: "CVE-2026-125387"
page: "https://infrastack.ai/live/CVE-2026-125387"
kind: "vulnerability"
aliases: ["CVE-2026-125387"]
title: "Faveo Helpdesk: agents can modify tickets outside their department"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["faveo-helpdesk", "other", "php", "self-hosted"]
not_affected_if: ["no-agent-accounts", "single-department-setup", "version-above-2.0.3"]
published_at: "2026-11-10T00:17:12+00:00"
first_seen_at: "2026-11-10T00:28:43+00:00"
updated_at: "2026-11-10T00:30:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125387", "first_seen_at": "2026-11-10T00:28:43+00:00"}]
exploit_sources: []
---

# Faveo Helpdesk: agents can modify tickets outside their department

Link for people: https://infrastack.ai/live/CVE-2026-125387 (this .md is for agents)

Faveo Helpdesk through 2.0.3 lets logged-in agents reference raw ticket IDs to act on tickets in other departments. An attacker with an agent account can close, merge, reassign and read the subjects of other departments' customer tickets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Faveo Helpdesk version against the range through `2.0.3`
- Review whether agents from one department can reach tickets owned by another department in the TicketController endpoints (merge-tickets, change-owner, ticket/assign, ticket/surrender)

## Timeline

- 2026-11-10T00:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125387

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-tampering-via-ticketcontroller
- [fix] Patch: github.com https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1
- [fix] Patch: github.com https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078

## From the sources

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_