CVE-2026-78434: Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication
A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Faveo Helpdesk versions up to and including 2.0.3 are identified as affected. The issue is in the post-ticket-reply endpoint handled by FormController::post_ticket_reply.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require authentication or user interaction, according to the supplied vector. A published exploit is available and may be used.
What is the likely impact of exploitation?
The reported impact is limited to integrity and availability, with no confidentiality impact indicated. The vulnerability is rated medium severity with a CVSS score of 6.5.
Is a vendor fix available?
No vendor response or fix is described in the provided information. The project was reportedly notified through an issue report but had not responded at the time of publication.