CVE-2026-115972: FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
FaveoSuite Faveo Helpdesk versions up to 2.0.3 are identified as affected. The issue is in the client helpdesk UnAuthController.php controller.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied vector. An attacker manipulates the id or status argument supplied to the changeStatus, close, open, or resolve functions.
What could an attacker do?
Missing authorization may allow an attacker to change the status of helpdesk items through the affected controller functions. The available data indicates an integrity impact and does not identify confidentiality or availability impact.
How can I determine whether my instance is at risk?
Verify whether the deployed Faveo Helpdesk version is 2.0.3 or earlier and whether the affected UnAuthController methods are reachable in the deployment. Review requests to the relevant status-changing functionality for unexpected id or status manipulation.