Faveo Helpdesk CVE-2026-111676

Requires a valid authenticated Faveo Helpdesk agent account (PR:L); exploitation targets the getTooltip handler reached via GET /ticket/tooltip with an attacker-controlled sequential ticketid parameter. The endpoint is a standard application route, so exploitation works against default configurations with no special feature toggle needed. Limiting factors: the attacker must first possess or obtain agent-level credentials, the flaw is read-only (confidentiality disclosure of ticket conversations, customer PII, and internal notes - no modification or denial of service), and impact scales only with the number of enumerable ticket IDs.

This is a moderate, confidentiality-only broken access control (IDOR) issue, not a top-tier priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score are internally consistent with the description: network-reachable, low complexity, but requiring an authenticated agent account (PR:L), with only low confidentiality impact (VC:L) and no integrity or availability impact. No EPSS score, no CISA KEV listing, and no explicit POC/exploit-code flag were provided in the input, so there is no signal of active or widespread exploitation - SSVC-style, this reads as 'exploitation: none proven' with technical impact 'partial' and low automatability beyond trivial ID enumeration. The one aggravating factor is that a detailed public technical write-up (hackmd) and a VulnCheck advisory describe the exact vulnerable endpoint and the sequential-ID enumeration method, which materially lowers the barrier to building an exploit even though no packaged exploit is listed. Net: a real but limited insider/low-privilege data-exposure risk, appropriate for routine patching rather than emergency response. Note one labeling conflict: the input Tag 'Authentication Bypass' contradicts the description and CWE-639 (authorization bypass) - this is an authenticated authorization flaw, not an authentication bypass.

An attacker who already holds a low-privileged Faveo agent account (or a compromised agent login) issues repeated GET /ticket/tooltip requests while incrementing the ticketid parameter, harvesting ticket conversations from departments they are not authorized to view. Because the getTooltip handler omits a department authorization check, the agent can systematically scrape customer PII and internal agent notes. No packaged exploit is listed, but a public technical write-up documents the exact endpoint and enumeration technique.