CVE-2026-115972

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.

• CWE-862
• CWE-863

• https://vuldb.com/cve/CVE-2026-115972
• https://vuldb.com/submit/986183
• https://vuldb.com/vuln/426053
• https://vuldb.com/vuln/426053/cti

Published

Oct 24, 2026

Last Modified

Oct 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11595IBM WebSphere Application Server 9.0, and 8.5 could allow a …7.5
• CVE-2026-11596In ScreenConnect™ versions prior to 26.2, input validation w…4.7
• CVE-2026-115969A flaw has been found in Travisun Opptrix 0.4.0. This affect…7.3
• CVE-2026-11597The Surbma | Infusionsoft Shortcode plugin for WordPress is …6.4
• CVE-2026-115970A vulnerability has been found in Travisun Opptrix 0.4.0. Th…7.3
• CVE-2026-115971A vulnerability was found in Travisun Opptrix 0.4.0. Affecte…5.3
• CVE-2026-115975Broken access control in JiraController in Cervantes version…7.1
• CVE-2026-11598The Shortcodify plugin for WordPress is vulnerable to Stored…5
• CVE-2026-115993Stored XSS vulnerability in the “Notes” field of the Checkli…6.8
• CVE-2026-115994BOLA Allows Cross-Project Target Tampering  in Cervantes ver…5.4
• CVE-2026-115998IDOR in Cervantes version v1.3-beta could allow an authentic…4.3
• CVE-2026-1160A security vulnerability has been detected in PHPGurukul Dir…9.8