Unauthenticated ticket reply injection via unprotected route

Missing authentication in Faveo Helpdesk 2.0.0 through 2.0.3 allows remote attackers to inject replies into arbitrary ticket threads. The post-ticket-reply route sits outside the authentication middleware, and post_ticket_reply writes a thread row under the original owner's user ID. No account or user interaction is required; knowing or guessing a sequential ticket number is enough to write attacker-controlled content under the owner's identity.