CVE-2026-72554: Ladybird Web Solution Faveo Helpdesk - Broken Access Control
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticated user to access arbitrary ticket threads including internal agent notes containing sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72554?
The severity of CVE-2026-72554 is medium with a score of 6.5.
How do I fix CVE-2026-72554?
To fix CVE-2026-72554, implement proper access controls to verify ticket ownership before allowing access to ticket conversations.
What systems are affected by CVE-2026-72554?
CVE-2026-72554 affects Ladybird Web Solution Faveo Helpdesk version 2.0.3.
What type of vulnerability is CVE-2026-72554?
CVE-2026-72554 is a broken access control vulnerability that allows unauthorized access to ticket conversations.
What impact does CVE-2026-72554 have on users?
CVE-2026-72554 allows self-registered customers to read other customers' ticket conversations, compromising data privacy.