# CVE-2026-111676: Faveo Helpdesk broken access control in ticket viewing

Source: https://junglewise.ai/threats/cve-2026-111676-faveo-helpdesk-through-2-0-3-contains-a-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111676 · Severity: medium · CVSS 4.3 · Published 2026-10-16

Faveo Helpdesk is a customer support ticketing system used by organizations to manage help requests. A flaw in its access controls allows authenticated support agents to read tickets from departments they are not assigned to by directly requesting ticket data, potentially exposing confidential customer information and internal agent notes. An attacker with an agent account can enumerate and access sensitive support tickets across the entire system.

Technologies: [Faveo Helpdesk](https://junglewise.ai/threats/technologies/faveo-helpdesk-1). Vendors: [Faveo](https://junglewise.ai/threats/vendors/faveo).

## Quick answers

**Is CVE-2026-111676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111676 being exploited in the wild.

**How severe is CVE-2026-111676?** Medium severity, with a CVSS score of 4.3, published 16 October 2026.

**Which products and versions are affected?** Faveo Helpdesk through 2.0.3.

**Is there a fix for CVE-2026-111676?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111676 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111676?** Check whether you run Faveo Helpdesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue in the TicketController's getTooltip handler that fails to validate department permissions. An authenticated agent can bypass department authorization checks by directly accessing the GET /ticket/tooltip endpoint with sequential ticketid values, allowing enumeration and unauthorized read access to ticket conversations. The fix requires implementing proper authorization checks to ensure agents can only access tickets from their assigned departments.

## Affected products

- Faveo Helpdesk through 2.0.3

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php](https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php)
- [https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/routes/web.php](https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/routes/web.php)

## Related threats

- [Faveo Helpdesk authorization bypass in TicketController](https://junglewise.ai/threats/cve-2026-125387-faveo-helpdesk-through-2-0-3-contains-an-authorization-bypass)
- [Faveo Helpdesk access control bypass in ticket PDF export](https://junglewise.ai/threats/cve-2026-124025-faveo-helpdesk-through-2-0-3-contains-a-broken-access-control)