CVE-2026-78434

Name of the Vulnerable Software and Affected Versions Faveo Helpdesk versions prior to 2.0.4

Description An authentication bypass exists in the post-ticket-reply endpoint. This issue occurs within the FormController::post ticket reply() function located in the app/Http/Controllers/Client/helpdesk/FormController.php file. A remote attacker can exploit this flaw to perform actions without proper authentication.

Recommendations As a temporary workaround, restrict access to the post-ticket-reply endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.