CVE-2026-124025

Description

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/faveosuite/faveo-helpdesk/issues/8369 ↗
• https://github.com/faveosuite/faveo-helpdesk ↗
• https://github.com/faveosuite/faveo-helpdesk/commit/408076c7fa921133920decceec306b194affdcee ↗
• https://github.com/faveosuite/faveo-helpdesk/releases/tag/v2.0.4.RC.1 ↗
• https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L490 ↗
• https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-disclosure-via-ticket-print ↗