by Kastro
Paper/Archive/CVE-2026-92805

CVE-2026-92805

uvdesk community-skeleton — UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.7.507 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.

Affected

ProductAffectedFixed inSource
community-skeleton≤ 1.1.8–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/uvdesk/community-skeleton/issues/926refgithub.com/uvdesk/community-skeletonwriteupgithub.com/uvdesk/community-skeleton/blob/6f35040/src/Resources/config/routes.yaml#L1-L35writeupvulncheck.com/advisories/uvdesk-community-skeleton-through-1.1.8-missing-authentication-on-the-installation-wizard