CVE-2026-115972

FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authorization check in FaveoSuite Faveo Helpdesk's UnAuthController functions, which allows an attacker to manipulate the id and status arguments. An attacker can remotely change ticket status, close, open, or resolve tickets without having the required permissions. This leads to integrity violations on support tickets and can compromise the business logic of the helpdesk system.

Affected Systems

FaveoSuite Faveo Helpdesk versions up to and including 2.0.3 are affected. Any installation running 2.0.3 or earlier and exposing the UnAuthController endpoints is vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attacker can launch the exploit remotely by sending crafted HTTP requests to the UnAuthController endpoints. Though the exploit does not require privileged credentials, it bypasses authorization checks, allowing unauthorized users to alter ticket data and potentially disrupt support operations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Faveo Helpdesk to a version that includes the authorization fix or apply the vendor‑provided patch.
  • Until a patch can be applied, block or remove the UnAuthController routes that allow status changes from external access in the web server or application configuration.
  • Configure the helpdesk system to enforce authentication and role‑based authorization for all ticket status changes, ensuring only privileged users can execute close, open, or resolve actions.

Generated by OpenCVE AI on October 24, 2026 at 19:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Faveosuite faveo-helpdesk
Vendors & Products Faveosuite faveo-helpdesk
Type Values Removed Values Added
Description A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.
Title FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
First Time appeared Faveosuite
Faveosuite faveo Helpdesk
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:faveosuite:faveo_helpdesk:*:*:*:*:*:*:*:*
Vendors & Products Faveosuite
Faveosuite faveo Helpdesk
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 6:28 PM
Reserved
Oct 24, 2026, 12:52 AM

View source JSON

Updated
Oct 29, 2026, 6:28 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 6:16 PM
Modified
Oct 29, 2026, 7:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 8:00 PM

JSON