CVE-2026-124025
4.3 MEDIUMpublic exploit availablePublished 2026-11-06 · Updated 2026-11-11
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639
Public exploit & PoC references
- https://github.com/faveosuite/faveo-helpdesk
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L490
- https://github.com/faveosuite/faveo-helpdesk/commit/408076c7fa921133920decceec306b194affdcee
- https://github.com/faveosuite/faveo-helpdesk/issues/8369
- https://github.com/faveosuite/faveo-helpdesk/releases/tag/v2.0.4.RC.1
All references
- https://github.com/faveosuite/faveo-helpdesk
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L490
- https://github.com/faveosuite/faveo-helpdesk/commit/408076c7fa921133920decceec306b194affdcee
- https://github.com/faveosuite/faveo-helpdesk/issues/8369
- https://github.com/faveosuite/faveo-helpdesk/releases/tag/v2.0.4.RC.1
- https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-disclosure-via-ticket-print
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2024-34323
- MEDIUMCVE-2025-71420PoC
- MEDIUMCVE-2026-100142
- UNSCOREDCVE-2026-100177PoC
- HIGHCVE-2026-100268
- MEDIUMCVE-2026-100272
- HIGHCVE-2026-100364PoC
- HIGHCVE-2026-100514
Related by shared AI tags and CWE weakness class. Browse the full archive.