Description

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T22:17:21.190Z",
  "pubdate": "2026-08-24T22:17:21.190Z",
  "executiveSummary": "A missing authentication vulnerability has been identified in Faveo Helpdesk up to version 2.0.3, specifically within the post-ticket-reply endpoint handled by the FormController::post_ticket_reply function.\nThis security flaw allows remote, unauthenticated attackers to interact with vulnerable systems and manipulate ticket reply submissions without verifying user identity or session validity.\nThe vulnerability directly impacts the application's access control architecture, exposing critical ticket management functionality to unauthorized external entities.\nThe risk implications are significant as malicious actors can abuse the exposed endpoint remotely, potentially leading to unauthorized data insertion, ticket tampering, or workflow disruption within affected support systems.\nExploitation requires network connectivity to the targeted Faveo Helpdesk instance and the ability to craft HTTP requests directed at the vulnerable post-ticket-reply endpoint.\nBecause public exploit material is available and the vendor has not yet responded to early issue reports, immediate defensive attention and compensatory controls are required to secure vulnerable deployments.",
  "technicalDetails": "The vulnerability resides in the FormController::post_ticket_reply function located within the app/Http/Controllers/Client/helpdesk/FormController.php file of Faveo Helpdesk up to version 2.0.3.\nThe root cause of the flaw is a complete absence of proper authentication checks or access control enforcement within the post-ticket-reply endpoint handling logic.\nUnder normal operating conditions, actions modifying or appending data to support tickets should strictly validate the session state, user privileges, and authorization tokens of the entity initiating the request.\nDue to the missing authentication validation, the application processes incoming requests to the vulnerable controller function regardless of whether the sender possesses a valid authenticated session.\nAn attacker can exploit this flaw remotely by sending crafted HTTP requests directly to the post-ticket-reply endpoint without supplying valid credentials, session cookies, or API keys.\nThe attack flow proceeds as follows: First, the remote attacker identifies the exposed endpoint associated with FormController::post_ticket_reply on a target running an affected version of Faveo Helpdesk up to 2.0.3.\nSecond, the attacker constructs an HTTP payload containing arbitrary ticket reply parameters required by the underlying controller method.\nThird, the attacker transmits the crafted request across the network to the target application.\nFourth, because the vulnerable function fails to verify authentication tokens or enforce privilege requirements, the application accepts the payload and executes the handler logic.\nFinally, the input is processed by the backend, resulting in unauthorized state changes or unauthorized data insertion into the helpdesk ticketing database.\nPost-exploitation impact includes unauthorized ticket manipulation, potential communication spoofing within support threads, and degradation of system integrity due to unauthenticated interactions."
}