Threat database

CVE-2026-115973 is a medium severity vulnerability in FaveoSuite Faveo Helpdesk version 2.0.3 affecting the password recovery functionality. The issue lies in the ForgotPasswordController::sendResetLinkEmail and PasswordController::reset functions, which allow weak password recovery mechanisms. This vulnerability can be exploited remotely without authentication and may lead to compromised account recovery processes.

CVE-2026-115972 is a medium severity vulnerability in FaveoSuite Faveo Helpdesk versions 2.0.0 through 2.0.3. It involves missing authorization checks in several functions of the UnAuthController, allowing remote attackers to manipulate status-related arguments without proper authorization.

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.