Executive brief
Faveo Helpdesk is an open-source ticketing and customer support system. A flaw in the REST API allows any registered customer to view support tickets and conversations belonging to other customers, including sensitive internal notes. An attacker with a self-registered account can access confidential customer data and agent communications without authorization.
Technical details
This is a broken access control vulnerability (authorization bypass) in the v1 REST API of Faveo Helpdesk 2.0.3. The API endpoint that retrieves ticket conversations verifies whether a requested ticket exists, but fails to validate that the authenticated user owns or has permission to access that ticket. An authenticated attacker can enumerate or directly request ticket IDs and access the full conversation thread, including internal notes. The vulnerability requires an attacker to have a valid account (self-registration capability), which is a low barrier. No patch availability was indicated in the advisory.
Affected products
- Ladybird Web Solution Faveo Helpdesk 2.0.3
Timeline
- 2026-08-11: disclosed