CVE-2026-125387

Description

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/faveosuite/faveo-helpdesk/issues/8368 ↗
• https://github.com/faveosuite/faveo-helpdesk ↗
• https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L2230-L2300 ↗
• https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1 ↗
• https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078 ↗
• https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-tampering-via-ticketcontroller ↗