Is CVE-2026-78434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78434 being exploited in the wild.

How severe is CVE-2026-78434?

Medium severity, with a CVSS score of 6.5, published 24 August 2026.

Is there a fix for CVE-2026-78434?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78434 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78434?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78434: Faveo Helpdesk authentication bypass in ticket reply endpoint

CVE-2026-78434 · Severity: medium · CVSS 6.5 · Published 2026-08-24

Faveo Helpdesk is a customer support platform used to manage help desk tickets and customer communications. An unauthenticated attacker can inject malicious replies into any support ticket and have them attributed to the legitimate ticket owner, enabling fraud, defamation, or social engineering attacks against support staff and customers. No legitimate access credentials are required to exploit this flaw.

Quick answers

Is CVE-2026-78434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78434 being exploited in the wild.
How severe is CVE-2026-78434?: Medium severity, with a CVSS score of 6.5, published 24 August 2026.
Which products and versions are affected?: Faveo Helpdesk up to 2.0.3.
Is there a fix for CVE-2026-78434?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78434 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78434?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication check (CWE-306) in the POST /post-ticket-reply/{id} endpoint. The route is registered outside the auth middleware group in routes/web.php (line 558), while all other ticket reply routes are protected. The FormController::post_ticket_reply handler does not validate the request comes from an authenticated user or verify the requester is the ticket owner. An unauthenticated attacker can submit a POST request with a subject ending in [#ticket_number] to inject a thread reply that is attributed to the original ticket owner's user ID. The vulnerability also exposes an IDOR in the rating endpoints (CWE-639) allowing authenticated customers to rate any ticket. Network access is required; no user interaction is needed. Patches have not been released as the vendor has not responded to the disclosure.

Affected products

Faveo Helpdesk up to 2.0.3

Timeline

2026-05-26: disclosed: Initial vulnerability report via email
2026-08-24: advisory: CVE-2026-78434 published
2026-07-10: other: Public issue filed on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.