Description
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FaveoSuite | Faveo Helpdesk | 2.0.0, 2.0.1, 2.0.2, 2.0.3 | — |
References
- VDB-426053 | FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization vdb-entry technical-description
- VDB-426053 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-115972 | CVE Analysis and Report third-party-advisory
- Submit #986183 | Faveo Faveo Helpdesk 2.0.3 Missing Authorization third-party-advisory