Junglewise Threat Intelligence

CVE-2026-72554: Ladybird Faveo Helpdesk broken access control in v1 REST API

CVE-2026-72554 · Severity: medium · CVSS 6.5 · Published 2026-08-11

Executive brief

Faveo Helpdesk is an open-source ticketing and customer support system. A flaw in the REST API allows any registered customer to view support tickets and conversations belonging to other customers, including sensitive internal notes. An attacker with a self-registered account can access confidential customer data and agent communications without authorization.

Technical details

This is a broken access control vulnerability (authorization bypass) in the v1 REST API of Faveo Helpdesk 2.0.3. The API endpoint that retrieves ticket conversations verifies whether a requested ticket exists, but fails to validate that the authenticated user owns or has permission to access that ticket. An authenticated attacker can enumerate or directly request ticket IDs and access the full conversation thread, including internal notes. The vulnerability requires an attacker to have a valid account (self-registration capability), which is a low barrier. No patch availability was indicated in the advisory.

Affected products

  • Ladybird Web Solution Faveo Helpdesk 2.0.3

Timeline

  • 2026-08-11: disclosed

References