CVE-2026-111676
Received Received - Intake

Faveo Helpdesk Broken Access Control Exposes Ticket Data

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111676
EUVD
EUVD-2026-102967

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
faveosuite faveo-helpdesk 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Faveo Helpdesk through version 2.0.3 has a broken access control vulnerability in the /ticket/tooltip endpoint. Authenticated agents can read tickets from other departments by sending GET requests with sequential ticket IDs. The endpoint retrieves full ticket conversations without enforcing department or assignment checks, exposing sensitive customer data and internal agent notes.

Detection Guidance

To detect this vulnerability, check for unauthorized access to the /ticket/tooltip endpoint. Use tools like curl to send GET requests with sequential ticket IDs and verify if responses include ticket data outside the expected department or assignment. Example command: curl -u agent_username:password 'http://target.com/ticket/tooltip?ticketid=1' and check for unexpected data exposure.

Impact Analysis

If you are an agent using Faveo Helpdesk version 2.0.3 or earlier, attackers with agent credentials can access tickets outside your department. This may lead to exposure of customer personal data, billing details, and confidential internal communications. The vulnerability allows enumeration of sequential ticket IDs to extract sensitive information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The exposure of customer data and internal notes could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update Faveo Helpdesk to the latest patched version. If an update is unavailable, restrict access to the /ticket/tooltip endpoint by modifying the TicketController to enforce department and assignment checks. Temporarily disable the endpoint if necessary. Monitor logs for suspicious GET requests to /ticket/tooltip with varying ticket IDs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart