CVE-2026-115973

HIGH 7.3

FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.

CWE	CWE-640
Vendor	faveosuite
Product	faveo helpdesk
Published	Oct 24, 2026

Stay Ahead of the Next One

Get instant alerts for faveosuite faveo helpdesk

Be the first to know when new high vulnerabilities affecting faveosuite faveo helpdesk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

FaveoSuite / Faveo Helpdesk

2.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/426054 vuldb.com: https://vuldb.com/vuln/426054/cti vuldb.com: https://vuldb.com/cve/CVE-2026-115973 vuldb.com: https://vuldb.com/submit/986184

Credits

🔍 Ibrohimm (VulDB User) VulDB CNA Team