Faveo Helpdesk EUVD-2026-109313

The attack targets the Faveo Helpdesk password-reset functionality specifically - the ForgotPasswordController::sendResetLinkEmail and PasswordController::reset paths in app/Http/Controllers/Auth/ForgotPasswordController.php. The supplied CVSS vector indicates remote, unauthenticated reach with no user interaction (AV:N/PR:N/UI:N), so the forgot-password feature being exposed (its normal default state in a web-facing helpdesk) is the operative precondition. The exact manipulation that makes recovery 'weak' is not described in the available sources. Limiting factors: all impact metrics are rated Low in the input vector, affected scope is version 2.0.3, and no working exploit is confirmed, so realistic impact is bounded and not demonstrated to yield full compromise.

Signals point to a genuine but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an easy-to-reach flaw - network-reachable, low complexity, no privileges, no user interaction - but all impact metrics are Low (VC:L/VI:L/VA:L), yielding a 6.9 medium score, so the ease of access is offset by limited per-exploit impact. The input provides no EPSS probability, so widespread-exploitation likelihood cannot be quantified. The flaw is NOT in CISA KEV and no confirmed public exploit is present in the data; the CVSS 4.0 exploit maturity is E:X (undefined/unknown), so active exploitation is neither confirmed nor refuted. The vuln.today priority is 'this_month', not act_now or emergency, consistent with a patch-on-normal-cycle disposition. Key caveat: the description is vague ('manipulation leads to weak password recovery') and does not state the concrete trigger, and no fixed version is listed, so the real impact ceiling (whether this enables full account takeover) cannot be confirmed from the available sources and should be verified with the vendor.

A remote, unauthenticated attacker interacts with the Faveo Helpdesk forgot-password flow (ForgotPasswordController::sendResetLinkEmail / PasswordController::reset) and abuses a weakness in the password recovery mechanism (CWE-640) to influence or compromise the reset process for a targeted account. The specific trigger is not described in the available sources, and no public exploit code is identified at time of analysis, so feasibility details remain unverified.