Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-78434

CVE-2026-78434MEDIUM

Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    5.5   .0072   52.4     —

AFFECTED
  Product   Versions  Fixed
  Helpdesk  2.0.0 –   —

TIMELINE
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-78434 (Faveo Helpdesk). Public exploit reference added.
  Aug 24  Reserved by VulDB
  Aug 24  Published (CNA: VulDB)
  Aug 25  EXPLOIT PUBLISHED — CVE-2026-78434 (Faveo Helpdesk). Public exploit reference added.

CWE-287, CWE-306 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

Description

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-78434 (Faveo Helpdesk). Public exploit reference added.
August 24, 2026	Reserved	Reserved by VulDB
August 24, 2026	Published	Published (CNA: VulDB)
August 25, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-78434 (Faveo Helpdesk). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Faveo	Helpdesk	—	2.0.0	—

Weaknesses

CWE-287 · CWE-306

References (5)

Authoritative record: CVE-2026-78434 at cve.org

Vendors: faveo

Weaknesses: CWE-287 · CWE-306

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-78434 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.