CVE-2026-115972

MEDIUM 5.3

FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.

CWE	CWE-862 CWE-863
Vendor	faveosuite
Product	faveo helpdesk
Published	Oct 24, 2026

Stay Ahead of the Next One

Get instant alerts for faveosuite faveo helpdesk

Be the first to know when new medium vulnerabilities affecting faveosuite faveo helpdesk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

FaveoSuite / Faveo Helpdesk

2.0.0 2.0.1 2.0.2 2.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/426053 vuldb.com: https://vuldb.com/vuln/426053/cti vuldb.com: https://vuldb.com/cve/CVE-2026-115972 vuldb.com: https://vuldb.com/submit/986183

Credits

🔍 Ibrohimm (VulDB User) VulDB CNA Team