Broken Access Control Vulnerability in Faveo Helpdesk by Ladybird Web Solution

CVE-2026-72554

What is CVE-2026-72554?

A broken access control issue in Faveo Helpdesk version 2.0.3 allows self-registered customers to access ticket conversations belonging to other customers through the v1 REST API. The API checks for the existence of the requested ticket but fails to validate the ownership, leading to unauthorized access to arbitrary ticket threads. This vulnerability can expose sensitive information, including internal notes from agents, to users who should not have access to them.

References