MEDIUMCVSS v3.1 5.4Vulnerability
CVE-2026-125387
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Epss score
- 0.00198
- Cvss severity
- MEDIUM
- Cvss score
- 5.4
- Retrieved at
- 2026-11-10T23:35:17+00:00
- Last source
- FIRST EPSS
- Score
- 5.4
- Cvss version
- 3.1
- Cve id
- CVE-2026-125387
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-11-10T03:20:44+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Published at
- 2026-11-10T00:17:12.157
- Last modified
- 2026-11-10T19:21:12.383
- Epss percentile
- 0.09658
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph