CVE-2026-111676: Authorization Bypass Through User-Controlled Key in faveosuite faveo-helpdesk

CVE-2026-111676 describes a broken access control vulnerability in Faveo Helpdesk through version 2.0.3. Authenticated agents can exploit the getTooltip handler by enumerating sequential ticket IDs on the GET /ticket/tooltip endpoint to access ticket conversations belonging to other departments. This unauthorized access exposes sensitive information including customer personal data and internal agent notes. The vulnerability is rated medium severity with a CVSS 4.0 base score of 5.3, indicating a network attack vector with low complexity and no user interaction required.

Authenticated agents can bypass access controls to read tickets from other departments, potentially exposing sensitive customer data and internal notes. This could lead to privacy violations and information disclosure within the helpdesk environment. There is no indication of privilege escalation beyond authenticated agent access or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated agent permissions to only necessary departments and monitor access patterns for suspicious enumeration of ticket IDs.