CVE-2026-115973High· 7.3▾ TwilightA vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordControll…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
faveo_helpdesk 2.0.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115972Medium· 5.3FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
CVE-2026-111676Medium· 4.3Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint
CVE-2026-58202High· 8.3OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`
CVE-2026-46346Medium· 6.5Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
CVE-2026-46347Medium· 6.8Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset
CVE-2026-86055High· 8.7Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover