CVE-2026-124025: falha de média gravidade em faveosuite faveo-helpdesk
Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
faveosuite · faveo-helpdeskCVEs relacionadas — faveosuite faveo-helpdesk
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/faveosuite/faveo-helpdeskhttps://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L490https://github.com/faveosuite/faveo-helpdesk/commit/408076c7fa921133920decceec306b194affdceehttps://github.com/faveosuite/faveo-helpdesk/issues/8369https://github.com/faveosuite/faveo-helpdesk/releases/tag/v2.0.4.RC.1https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-disclosure-via-ticket-print