Threats tagged 'ghsa-x7f6-pmcc-xv54'

Faveo Helpdesk versions up to 2.0.3 have an authorization bypass vulnerability in the TicketController. Authenticated agents can exploit this flaw to modify tickets outside their assigned departments by referencing raw ticket IDs. This allows attackers to perform actions such as merging tickets, changing ownership, assigning tickets, and surrendering tickets belonging to other departments. Additionally, attackers can enumerate ticket subjects of customers.