Threat database

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.

CVE-2026-78435 is a path traversal vulnerability in Faveo Helpdesk affecting versions 2.0.0 through 2.0.3. The flaw exists in the unlink function of the Logo Handler component, specifically in app/Http/Controllers/Admin/helpdesk/SettingsController.php. An attacker can remotely manipulate the argument data1 to perform path traversal. The vulnerability has been publicly disclosed, but no official vendor response or patch is available yet.

CVE-2026-78434 is a medium severity vulnerability in Faveo Helpdesk versions 2.0.0 through 2.0.3. It affects the post_ticket_reply function in the FormController component, causing missing authentication. This allows remote attackers to potentially exploit the endpoint without proper authentication. The vulnerability has a CVSS 4.0 base score of 6.9. Although an exploit has been published, there is no vendor response or patch available yet.

An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields