Faveo Helpdesk versions up to 2.0.3 suffer from a broken access control flaw that lets an authenticated agent read tickets belonging to other departments by using the /ticket/tooltip endpoint. The flaw allows enumeration of ticket IDs on GET /ticket/tooltip, exposing ticket conversations, customer personal data, and internal agent notes. The weakness is a classic example of inappropriate authorization (CWE-639).

The vulnerability affects Faveo Helpdesk as provided by Faveo Suite. Versions released through 2.0.3 are impacted and are not recommended for use.

The CVSS base score of 5.3 classifies the issue as moderate severity. The EPSS score is not available, so no weighting can be applied for likely exploitation frequency. The vulnerability is listed outside the CISA KEV catalog, reducing the likelihood of widespread exploitation. The attack surface is an authenticated agent inside the helpdesk application; attackers need valid login credentials to trigger the data leakage. No public exploitation method is documented, but an insider or compromised agent account can mount the attack by iterating ticket IDs.