CVE-2026-72554

CVE-2026-72554 in Faveo Helpdesk exposes a classic IDOR via the REST API that returns ticket data without proper ownership verification. The CVSS 6.5 rating substantially understates the risk because it fails to capture the compound effect of three design choices that individually seem reasonable but together create a severe exposure: self-registration allows anyone to create an account at zero cost, the API enables programmatic enumeration (transforming manual browsing into bulk harvesting), and agent notes contain exactly the sensitive context that was never meant for customer eyes — PII gathered during support, security incident details, password reset tokens, internal architecture notes from troubleshooting sessions. The critical distinction this CVE exposes: traditional IDOR assumes an attacker must find and exploit a vulnerability. Here, the attack surface is open by design. A self-registered user who simply checks "my ticket status" and iterates through a few ID numbers encounters other customers' full support threads — including internal agent notes. Curiosity, not exploitation skill, becomes the attack vector. This inverts the threat model CVSS assumes. Worse, Faveo Helpdesk functions as an integration hub connecting to email systems, authentication backends, identity providers, and CRM platforms. Agent notes don't just contain support conversation — they contain the troubleshooting context of an agent handling a real account problem: a documented credential compromise, a password reset request, a flagged suspicious activity. One bulk harvest doesn't expose isolated tickets; it exposes the map of trusted relationships between systems. That's actionable intelligence for lateral movement. The practical implication: treat internal agent notes in any helpdesk system as a high-sensitivity data class regardless of access control architecture. The assumption that "customer-facing code won't return internal notes" is precisely the vulnerability pattern that keeps repeating. Verify that your helpdesk API enforces ownership verification on every endpoint — not just whether a user is authenticated, but whether the requested resource belongs to that user. Review whether self-registration should be permitted for production environments, or at minimum implement rate limiting and anomaly detection on ticket enumeration patterns. The data sensitivity in agent notes justifies controls well beyond what a CVSS 6.5 would suggest.

Reviewed through automated stages and approved by a human before publication.