Is CVE-2026-111676 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111676?

CVE-2026-111676 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-111676

Description

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.