CVE-2026-72554

Name of the Vulnerable Software and Affected Versions Ladybird Web Solution Faveo Helpdesk version 2.0.3

Description A broken access control issue exists in the v1 REST API. The API verifies if a requested ticket exists but fails to verify if the authenticated user owns that ticket. This allows any self-registered customer to read arbitrary ticket conversations, including internal agent notes that may contain sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.