CVE-2026-72554: Faveo Helpdesk Auth Bypass Vulnerability

CVE-2026-72554 Overview

CVE-2026-72554 is a broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk version 2.0.3. The flaw resides in the v1 REST API, which validates the existence of a requested ticket but fails to verify the caller's ownership of that ticket. Any self-registered customer holding a valid authentication token can enumerate ticket identifiers and retrieve conversations belonging to other customers. The exposed data includes internal agent notes, which frequently contain sensitive operational information, credentials, or personally identifiable data.

Critical Impact
Authenticated customers can read arbitrary ticket threads across the tenant, exposing private customer communications and internal agent notes through the v1 REST API.

Affected Products

Ladybird Web Solution Faveo Helpdesk 2.0.3
Faveo Helpdesk v1 REST API endpoints for ticket conversations
Deployments exposing customer self-registration on affected versions

Discovery Timeline

2026-08-11 - CVE-2026-72554 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72554

Vulnerability Analysis

The vulnerability is a broken access control weakness classified under [CWE-284]. Faveo Helpdesk's v1 REST API exposes endpoints that return ticket conversation data when supplied with a ticket identifier. The controller confirms that the requested ticket exists in the database but does not compare the ticket owner against the authenticated principal making the request. Any customer who completes the self-registration flow receives an API token that is sufficient to invoke these endpoints.

The result is a horizontal privilege escalation across the customer tenant. An attacker enumerates sequential or guessable ticket identifiers and receives full conversation threads for tickets they did not open. Because the API also returns internal agent notes, the exposure extends beyond customer-visible messages into staff-only content that agents assume is private.

Root Cause

The root cause is a missing authorization check between the authenticated user and the ticket resource. Authentication verifies who the caller is, but the endpoint does not enforce that the caller owns or is otherwise entitled to view the ticket. This is a canonical Insecure Direct Object Reference pattern layered on top of broken access control.

Attack Vector

Exploitation requires network access to the API and a low-privileged authenticated account, which any attacker can obtain via customer self-registration. No user interaction is required from the victim. The attacker iterates ticket IDs against the v1 conversation endpoint and parses the returned JSON for message bodies and internal notes. No verified public proof-of-concept is currently available. Refer to the Faveo Helpdesk GitHub repository for source-level details of the affected controllers.

Detection Methods for CVE-2026-72554

Indicators of Compromise

High-volume sequential or fuzzed requests to /api/v1 ticket conversation endpoints from a single authenticated customer session.
API responses returning ticket data where the requesting user is not the ticket creator or assigned participant.
Spikes in customer self-registration followed immediately by API token usage against ticket endpoints.

Detection Strategies

Correlate authenticated user IDs in application logs against the owner field of returned tickets, alerting on mismatches.
Deploy WAF or API gateway rules that rate-limit ticket lookups per authenticated account and flag enumeration patterns.
Review Faveo application logs for unusual GET request volume against v1 ticket conversation routes.

Monitoring Recommendations

Enable verbose API access logging including authenticated user identity, ticket ID requested, and response size.
Alert on any single account accessing more than a defined threshold of distinct ticket IDs within a short interval.
Monitor egress data volumes from the helpdesk application for anomalous JSON payload transfers to customer accounts.

How to Mitigate CVE-2026-72554

Immediate Actions Required

Disable customer self-registration on internet-facing Faveo Helpdesk 2.0.3 deployments until a patch is applied.
Revoke and rotate all customer API tokens issued by affected instances to invalidate reconnaissance sessions.
Restrict access to the v1 REST API at the network or reverse-proxy layer where feasible.

Patch Information

No vendor patch reference is listed in the NVD entry at time of publication. Administrators should monitor the Ladybird Web Solution Faveo Helpdesk repository for a fixed release and apply upgrades that add ownership verification to the v1 ticket conversation controller.

Workarounds

Front the API with a reverse proxy that enforces per-user ticket ID allow-lists derived from the authenticated session.
Remove or scrub internal agent notes from tickets that contain credentials or sensitive operational data.
Require staff approval before activating self-registered customer accounts to reduce anonymous exploitation.

bash

# Example nginx snippet to restrict v1 ticket API access to trusted networks
location /api/v1/tickets/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://faveo_backend;
}