CVE-2026-115972
Deferred Deferred - Pending Action

Unauthenticated Authorization Bypass in Faveo Helpdesk

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulDB

Description
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-115972
EUVD
EUVD-2026-109312

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Faveo Helpdesk versions up to 2.0.3. It involves missing authorization checks in functions like changeStatus, close, open, and resolve within the UnAuthController.php file. An attacker can manipulate the 'id' or 'status' arguments to bypass authorization and perform unauthorized actions remotely.

Impact Analysis

An attacker could exploit this to modify ticket statuses, close or resolve tickets, or open restricted tickets without proper authorization. This could lead to unauthorized changes in helpdesk operations, data integrity issues, or potential access to sensitive information.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to helpdesk data, potentially violating integrity and access control requirements under GDPR and HIPAA. Unauthorized changes may lead to data breaches or improper handling of sensitive information.

Mitigation Strategies

Immediately upgrade Faveo Helpdesk to a version beyond 2.0.3 where the vulnerability is patched. If upgrading is not possible, restrict network access to the affected functions UnAuthController.changeStatus, UnAuthController.close, UnAuthController.open, and UnAuthController.resolve in app/Http/Controllers/Client/helpdesk/UnAuthController.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart