CVE-2026-124025: Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print

Published Nov 6, 2026

Updated

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticketprint and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Faveo Helpdesk agent can exploit it. The affected access checks do not verify whether the requested ticket belongs to the agent's department or is assigned to that agent.

What access does an attacker need to retrieve another department's ticket?

The attacker needs an authenticated agent account and an arbitrary ticket ID. They can send a GET request to /ticket/print/{id} to render the ticket as a PDF.

What information may be exposed?

The issue can disclose tickets from other departments, including their full conversation threads.

How can teams determine whether they may be affected?

Faveo Helpdesk versions through 2.0.3 are identified as affected. Review whether authenticated agents can request /ticket/print/{id} for ticket IDs outside their department or assignment and receive ticket PDF content.

CVE-2026-124025: Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to retrieve another department's ticket?

What information may be exposed?

How can teams determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to retrieve another department's ticket?

What information may be exposed?

How can teams determine whether they may be affected?