CyberRota Analysis
AI-GeneratedA broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows authenticated self-registered customers to access ticket conversations belonging to other users through the v1 REST API, as the system fails to verify ticket ownership. This can lead to exposure of sensitive information, including internal agent notes. Organizations using this version of the software should prioritize remediation to protect customer data and maintain confidentiality.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticated user to access arbitrary ticket threads including internal agent notes containing sensitive information.