CVE-2026-111676: Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Faveo Helpdesk agent can exploit it. The agent does not need user interaction and can access tickets assigned to other departments.
What does an attacker need to do?
The attacker can send GET requests to /ticket/tooltip while changing sequential ticketid values. This can expose ticket conversations, customer personal data, and internal agent notes.
Are systems affected by unauthenticated internet exposure?
The available information indicates authentication as an agent is required. The data does not establish whether any particular default deployment makes agent accounts externally accessible.
How can I determine whether data may have been exposed?
Review access logs for GET requests to /ticket/tooltip made by agent accounts, particularly requests containing multiple sequential ticketid values. The provided information does not specify available application audit events or log fields.