faveosuite has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.3 (medium). Most affected products: Faveo Helpdesk (2), faveo-helpdesk (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-115973High· 7.3FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery40CVE-2026-115972Medium· 5.3FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization29CVE-2026-111676Medium· 4.3Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler24
faveosuite vulnerabilities
CVEs affecting faveosuite, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-115972Medium· 5.3FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/H…
CVE-2026-115973High· 7.3FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordControll…
CVE-2026-111676Medium· 4.3Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /tick…