CVE-2026-78434: Missing Authentication in Faveo Helpdesk

This vulnerability in Faveo Helpdesk up to version 2.0.3 involves missing authentication in the post_ticket_reply function of the FormController (app/Http/Controllers/Client/helpdesk/FormController.php). The flaw allows remote attackers to interact with the post-ticket-reply endpoint without authentication, potentially enabling unauthorized actions. The issue was reported early to the project, but no fix or official response has been provided. An exploit is publicly available, but there is no evidence of active exploitation in the wild.

The missing authentication vulnerability allows remote attackers to bypass authentication controls on the post_ticket_reply endpoint, potentially enabling unauthorized ticket replies or other actions within the helpdesk system. This could lead to unauthorized information disclosure or manipulation of ticket data. The CVSS 4.0 score of 6.9 reflects a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

No official fix or patch is currently available from the vendor, and the project has not responded to the issue report. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider implementing network-level access controls or other compensating controls to restrict access to the vulnerable endpoint. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.