Threats tagged 'ghsa-p5r3-pjjx-rggv'

Faveo Helpdesk versions up to 2.0.3 have a broken access control vulnerability in the TicketController's ticket_print function and the pdfThread endpoint. This flaw allows authenticated agents to access and render PDF versions of tickets from other departments by requesting arbitrary ticket IDs. The vulnerability does not verify ticket department or assignment, exposing ticket conversation threads to unauthorized users.