Description
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FaveoSuite | Faveo Helpdesk | 2.0.3 | — |
References
- VDB-426054 | FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery vdb-entry technical-description
- VDB-426054 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-115973 | CVE Analysis and Report third-party-advisory
- Submit #986184 | Faveo Faveo Helpdesk 2.0.3 Weak Password Recovery Mechanism third-party-advisory