An authorization bypass flaw in the TicketController of Faveo Helpdesk allows a logged‑in agent to act on tickets that belong to other departments by using raw ticket identifiers. The flaw can be leveraged through the merge‑tickets, change‑owner, ticket/assign and ticket/surrender API endpoints, enabling an attacker to close, merge, reassign, or otherwise tamper with tickets across departmental boundaries. This results in unauthorized modification of ticket data, loss of integrity and potential exposure of customer ticket subjects, affecting the confidentiality and trustworthiness of the helpdesk system.

The vulnerability affects versions of Faveo Helpdesk up to and including 2.0.3. It applies to the "faveosuite:faveo-helpdesk" product family and is referenced in the vendor’s GitHub repository for the referenced ticket controller code.

The CVSS score of 5.3 indicates moderate severity, but because the bug is an authorization bypass requiring only authenticated agent access, the attack surface is large within an organization that has many agents. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending crafted API requests with a ticket ID that belongs to another department, a path that requires no elevated privileges beyond normal agent authentication.