FaveoSuite has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.3 (medium). Most affected products: Faveo Helpdesk (2), faveo-helpdesk (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-115973High· 7.3FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery40CVE-2026-115972Medium· 5.3FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization29CVE-2026-111676Medium· 4.3Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint24
FaveoSuite vulnerabilities
CVEs affecting FaveoSuite, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-115972Medium· 5.3FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/H…
CVE-2026-115973High· 7.3FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordControll…
CVE-2026-111676Medium· 4.3Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /tick…