This vulnerability in Faveo Helpdesk 2.0.3 arises from improper access control (CWE-284) in the v1 REST API. The API checks only if a ticket exists but fails to confirm that the requesting user owns the ticket. As a result, any authenticated self-registered customer can access ticket conversations and internal agent notes of other customers, potentially exposing sensitive information. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

An attacker with a self-registered customer account can access sensitive ticket conversations and internal notes of other customers. This leads to unauthorized disclosure of potentially sensitive information. There is no indication of impact on integrity or availability. The vulnerability does not require user interaction and has a network attack vector with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict self-registration or limit API access to trusted users if possible. Monitor vendor communications for updates on patches or official mitigations.