Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Ladybird Web Solution | Faveo Helpdesk | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://github.com/ladybirdweb/faveo-helpdesk |
|
Tue, 11 Aug 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 11 Aug 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticated user to access arbitrary ticket threads including internal agent notes containing sensitive information. | |
| Title | Ladybird Web Solution Faveo Helpdesk - Broken Access Control | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published:
Updated: 2026-08-11T15:17:06.829Z
Reserved: 2026-08-10T10:32:49.081Z
Link: CVE-2026-72554
Vulnrichment
Updated: 2026-08-11T15:17:02.424Z
NVD
Status : Received
Published: 2026-08-11T12:17:41.103
Modified: 2026-08-11T16:17:35.790
Link: CVE-2026-72554
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-11T17:00:11Z
-
CWE-284
Improper Access Control