SECURITYHIGHCVE-2026-115973

CVE-2026-115973: Weak Password Recovery in Faveo Helpdesk 2.0.3

Faveo Helpdesk 2.0.3 has a weak password recovery flaw in ForgotPasswordController and PasswordController, rated CVSS 7.3 (High).

Dylan H.

Security Team

October 25, 2026
1 min read
CVE-2026-115973: Weak Password Recovery in Faveo Helpdesk 2.0.3

Affected Products

  • FaveoSuite Faveo Helpdesk 2.0.3

Executive Summary

CVE-2026-115973 is a weak password recovery vulnerability in FaveoSuite Faveo Helpdesk 2.0.3. The affected code is ForgotPasswordController::sendResetLinkEmail and PasswordController::reset in app/Http/Controllers/Auth/ForgotPasswordController.php.

CVSS Score: 7.3 (High)

Vulnerability Details

FieldValue
CVE IDCVE-2026-115973
CVSS Score7.3 (High)
Weakness ClassWeak password recovery mechanism
Published2026-10-24

Impact

Weaknesses in a password recovery flow can allow account takeover, including of helpdesk agent and administrator accounts. Helpdesk systems commonly hold customer data and internal ticket history, so a compromised account can expose sensitive information.

Remediation

  1. Check the Faveo project for a fixed release and upgrade when available.
  2. Restrict access to the helpdesk login and recovery pages, for example by VPN or IP allowlist.
  3. Enforce MFA on privileged accounts.
  4. Monitor logs for unusual password reset requests.

References