CVE-2026-115973
Deferred Deferred - Pending Action

Weak Password Recovery in Faveo Helpdesk 2.0.3

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulDB

Description
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-115973
EUVD
EUVD-2026-109313

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FaveoSuite Faveo Helpdesk 2.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Faveo Helpdesk 2.0.3, specifically in the password recovery function. It allows attackers to manipulate the password reset process, leading to weak password recovery mechanisms. The issue is remotely exploitable and was disclosed to the vendor early.

Impact Analysis

An attacker could exploit this to gain unauthorized access to user accounts by resetting passwords. This may lead to data breaches, unauthorized actions, or further compromise of sensitive information stored in the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update Faveo Helpdesk to the latest version to address the weak password recovery vulnerability. Disable the affected ForgotPasswordController and PasswordController functions if no update is available. Monitor network traffic for unusual password reset requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart