{"id":"CVE-2026-115972","title":"FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization","summary":"A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/H…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-862","CWE-863"],"vendor":"FaveoSuite","product":"Faveo Helpdesk","affected":["faveo_helpdesk 2.0.0","faveo_helpdesk 2.0.1","faveo_helpdesk 2.0.2","faveo_helpdesk 2.0.3"],"published":"2026-10-24","updated":"2026-10-24","sourceUpdated":"2026-10-24T18:00:18.162Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115972","references":[{"url":"https://vuldb.com/vuln/426053","label":"VDB-426053 | FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization"},{"url":"https://vuldb.com/vuln/426053/cti","label":"VDB-426053 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-115972","label":"CVE-2026-115972 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/986183","label":"Submit #986183 | Faveo Faveo Helpdesk 2.0.3 Missing Authorization"}],"tags":["cve.org"],"ingestedAt":"2026-10-24T19:04:47.759Z","slug":"CVE-2026-115972","body":"## Overview\n\nA vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.\n\n## Affected\n\n- `faveo_helpdesk 2.0.0`\n- `faveo_helpdesk 2.0.1`\n- `faveo_helpdesk 2.0.2`\n- `faveo_helpdesk 2.0.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}