Faveo Helpdesk versions up to 2.0.3 contain a broken access control flaw in the TicketController::ticket_print and pdfThread endpoints. The check that verifies a ticket’s department or assignment is omitted, allowing an authenticated agent to request arbitrary ticket IDs via GET /ticket/print/{id}. The PDF generated by that request exposes the full conversation and other sensitive data from tickets in other departments. The issue is classified as CWE-639, indicating an authorization bypass that can leak confidential information.

The vulnerability affects the Faveo Suite Faveo Helpdesk application, versions through 2.0.3. Any agent role that can trigger the ticket print functionality is impacted, as the lack of department validation applies across all deployments of the affected releases.

With a CVSS score of 5.3 the flaw represents a moderate severity level. Exploitation requires only authenticated access to the Helpdesk and can be performed remotely via an HTTP GET request, with no need for additional network privileges. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, so no publicly known active exploit has been reported. Nonetheless, the unauthorized disclosure of customer ticket content can lead to privacy violations and regulatory non‑compliance, particularly in environments where multiple departments share a single instance of the application.