EUVD-2026-56024
GHSA-8xxh-mwc3-vmw6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable API requiring only a customer account (PR:L); no integrity or availability impact; high confidentiality loss via unrestricted ticket read.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticated user to access arbitrary ticket threads including internal agent notes containing sensitive information.
AnalysisAI
Broken access control in Faveo Helpdesk 2.0.3's v1 REST API exposes all ticket conversations to any self-registered customer. The endpoint validates that a requested ticket exists but performs no ownership check, so any authenticated customer can enumerate and read tickets belonging to other customers - including internal agent notes that may contain sensitive operational or personal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier (valid account only) makes this a practical risk in any multi-tenant deployment.
Technical ContextAI
Faveo Helpdesk (CPE: cpe:2.3:a:ladybird_web_solution:faveo_helpdesk:*:*:*:*:*:*:*:*) is a self-hosted open-source helpdesk platform built on Laravel. The vulnerability resides in its v1 REST API, which handles ticket thread retrieval. The root cause is CWE-284 (Improper Access Control): the API layer performs object-level existence checks (does this ticket ID exist?) but omits authorization checks (does the requesting user own or have rights to this ticket?). This is a classic Broken Object Level Authorization (BOLA/IDOR) pattern. Because the platform supports internal agent notes within ticket threads, a successful read also exposes privileged operational content not intended for customer visibility.
RemediationAI
The primary remediation is to upgrade to a version of Faveo Helpdesk beyond 2.0.3 once the vendor releases a patched build; no specific fixed version number has been confirmed in the available data (patch availability per upstream PR/commit should be verified at https://github.com/ladybirdweb/faveo-helpdesk). If an immediate upgrade is not possible, restrict v1 REST API access to authenticated agents only at the network or application gateway level - this prevents self-registered customers from reaching the affected endpoint entirely, though it may break legitimate customer-facing API integrations. Alternatively, disable self-service customer registration temporarily to raise the exploitation bar, accepting the trade-off of disrupted onboarding workflows. Organizations should also audit v1 API access logs for anomalous cross-customer ticket ID enumeration patterns (sequential or non-sequential ticket ID requests from a single customer account).
More in Faveo Helpdesk
View allFaveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely
public/rolechangeadmin in Faveo 1.9.3 allows CSRF. Rated high severity (CVSS 8.0), this vulnerability is remotely exploi
An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to
Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today