CVE-2026-111676 Details

A broken access control vulnerability has been identified in Faveo Helpdesk versions through 2.0.3. This vulnerability allows authenticated agents to access and read tickets from other departments via the 'getTooltip' handler. Agents can exploit this by enumerating ticket IDs on the 'GET /ticket/tooltip' endpoint to retrieve full ticket conversations, which may include personal customer data and internal notes meant for agents only.

The vulnerability can be addressed by modifying the 'getTooltip' method in the 'TicketController' to include the same authorization checks that are applied to other ticket-related methods. This involves calling the 'authorizeTicketAccess' function to ensure the agent is only accessing tickets within their own department or those assigned to them. Additionally, internal threads should be excluded from visibility to non-owning viewers.