CVE-2026-125387: Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Faveo Helpdesk agent can exploit it. The attacker needs to reference raw ticket IDs for tickets belonging to other departments.
What actions can an attacker perform?
An attacker can use the merge-tickets, change-owner, ticket/assign, and ticket/surrender endpoints to close, merge, or reassign tickets outside their department. They can also enumerate customer ticket subjects.
Are unauthenticated attackers affected?
No. Exploitation requires an authenticated agent account; the provided information does not indicate unauthenticated access.