CVE-2026-78434

Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication

State: Published
Severity: 6.9 Medium
Published: Aug 24, 2026
Updated: Aug 25, 2026
Reserved: Aug 24, 2026

Description

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.5 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.4 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-306 Missing Authentication
CWE-287 Improper Authentication

Affected Products

Product	Versions
HelpdeskFaveo	2.0.0Affected 2.0.1Affected 2.0.2Affected 2.0.3Affected

References

VDB-394712 | Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authenticationvdb-entrytechnical-description
VDB-394712 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-78434 | CVE Analysis and Reportthird-party-advisory
Submit #886394 | faveosuite faveo-helpdesk commit 6568aa4 Missing Authenticationthird-party-advisory
https://github.com/faveosuite/faveo-helpdesk/issues/8346exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.