Executive brief
Faveo Helpdesk is a customer support platform used to manage help desk tickets and customer communications. An unauthenticated attacker can inject malicious replies into any support ticket and have them attributed to the legitimate ticket owner, enabling fraud, defamation, or social engineering attacks against support staff and customers. No legitimate access credentials are required to exploit this flaw.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the POST /post-ticket-reply/{id} endpoint. The route is registered outside the auth middleware group in routes/web.php (line 558), while all other ticket reply routes are protected. The FormController::post_ticket_reply handler does not validate the request comes from an authenticated user or verify the requester is the ticket owner. An unauthenticated attacker can submit a POST request with a subject ending in [#ticket_number] to inject a thread reply that is attributed to the original ticket owner's user ID. The vulnerability also exposes an IDOR in the rating endpoints (CWE-639) allowing authenticated customers to rate any ticket. Network access is required; no user interaction is needed. Patches have not been released as the vendor has not responded to the disclosure.
Affected products
- Faveo Helpdesk up to 2.0.3
Timeline
- 2026-05-26: disclosed: Initial vulnerability report via email
- 2026-08-24: advisory: CVE-2026-78434 published
- 2026-07-10: other: Public issue filed on GitHub