Vulnerability record/PUBLISHED/Published Oct 24, 2026 18:15:15 UTC
CVE-2026-115973
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
Base score6.9/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityLowVC
Vulnerable system integrityLowVI
Vulnerable system availabilityLowVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
Exploit maturityNot definedE
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:XCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulDB
Last updatedOct 24, 2026 18:15:15 UTC
PublishedOct 24, 2026 18:15:15 UTC
ReservedOct 24, 2026 00:52:48 UTC
Credits
- Ibrohimm (VulDB User)
- VulDB CNA Team