---
id: CVE-2026-115972
title: >-
  FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve
  authorization
summary: >-
  A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3.
  Affected by this vulnerability is the function
  UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve
  of the file app/H…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-862
  - CWE-863
vendor: FaveoSuite
product: Faveo Helpdesk
affected:
  - faveo_helpdesk 2.0.0
  - faveo_helpdesk 2.0.1
  - faveo_helpdesk 2.0.2
  - faveo_helpdesk 2.0.3
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T18:00:18.162Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115972'
references:
  - url: 'https://vuldb.com/vuln/426053'
    label: >-
      VDB-426053 | FaveoSuite Faveo Helpdesk UnAuthController.php
      UnAuthController.resolve authorization
  - url: 'https://vuldb.com/vuln/426053/cti'
    label: 'VDB-426053 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-115972'
    label: CVE-2026-115972 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/986183'
    label: 'Submit #986183 | Faveo Faveo Helpdesk 2.0.3 Missing Authorization'
tags:
  - cve.org
ingestedAt: '2026-10-24T19:04:47.759Z'
---

## Overview

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.

## Affected

- `faveo_helpdesk 2.0.0`
- `faveo_helpdesk 2.0.1`
- `faveo_helpdesk 2.0.2`
- `faveo_helpdesk 2.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.