CVE-2026-78434

The flaw allows any attacker to post replies to tickets in Faveo Helpdesk without proper authentication, effectively bypassing all access controls for the post‑ticket‑reply endpoint. Because the request is accepted without any credential verification, an attacker could inject arbitrary content into ticket conversations, tamper with ticket history, or exfiltrate confidential customer data. The vulnerability is classified as an authentication bypass (CWE‑287) and a missing authentication check (CWE‑306).

All installations of Faveo Helpdesk up to and including version 2.0.3 are affected. The issue resides in the FormController::post_ticket_reply method located at app/Http/Controllers/Client/helpdesk/FormController.php, which handles the post‑ticket‑reply endpoint.

The CVSS score of 6.9 indicates a moderate severity and the publicly published exploit confirms that the flaw is usable. While the EPSS score is not available, the attack can be initiated remotely from any network that can reach the application, and the vulnerability remains unpatched in the current product variant. The exploit does not require any privileged state beyond network connectivity, so a wide range of adversaries could leverage it to compromise the integrity and confidentiality of ticket data. The vulnerability is not currently listed in the CISA KEV catalog, but the presence of a public exploit warrants prompt remediation.