Faveo Helpdesk EUVD-2026-109312

The specific prerequisite is network reachability of the Faveo Helpdesk client-side endpoints served by UnAuthController (the changeStatus/close/open/resolve actions), which by design are unauthenticated and therefore exposed without login. The attacker must supply a valid ticket id and a status value; since PR:N and UI:N, no credentials or victim interaction are required. What limits real-world impact is the narrow effect: per the vector only integrity is affected at a low level (VI:L), with no confidentiality or availability impact, so exploitation yields unauthorized ticket-status manipulation rather than data theft or outage. Exposure is further bounded by the product's limited deployment and by whatever version is running (affected: up to 2.0.3).

The signals are internally consistent and point to a moderate, integrity-only issue rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, which raises exposure, but the impact metrics are narrow: VC:N, VI:L, VA:N - only a limited integrity effect, with no confidentiality or availability impact. This matches CWE-862 (missing authorization) on the UnAuthController status-changing endpoints, where an attacker can alter ticket state but cannot read data or take the service down. The vuln.today Decision label is 'this_month' (not act_now/emergency), reinforcing a routine-patch priority. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided, so there is no evidence of active or probable near-term exploitation. The only sourcing is VulDB (cna@vuldb.com); there is no independent vendor advisory in the data, and the vendor was only 'contacted early,' implying no confirmed fix at disclosure. Net: a genuine but limited-impact authorization flaw worth scheduled remediation, not a drop-everything incident.

A remote, unauthenticated attacker sends crafted requests to the Faveo Helpdesk client endpoints exposed by UnAuthController, supplying a target ticket id and a desired status value. Because the authorization check is missing, the attacker can close, open, resolve, or otherwise change the status of tickets they do not own, tampering with support-ticket integrity. No public exploit code was identified in the provided data, and the limited integrity-only impact (VI:L) constrains the damage to unauthorized state changes.