CVE-2026-111676 — Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Att…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7