{"id":"CVE-2026-125387","published":"2026-11-10T00:17:12.157","lastModified":"2026-11-10T19:21:12.383","description":"Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/faveosuite/faveo-helpdesk","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L2230-L2300","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/issues/8368","tags":[]},{"url":"https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-tampering-via-ticketcontroller","tags":[]}],"exploitRefs":[{"url":"https://github.com/faveosuite/faveo-helpdesk","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L2230-L2300","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078","tags":[]},{"url":"https://github.com/faveosuite/faveo-helpdesk/issues/8368","tags":[]}],"hasPoc":true,"ai":null}