CVE-2026-92805

UVdesk Community Skeleton through version 1.1.8 does not authenticate requests or verify that installation has already been completed on wizard endpoints exposed by the ConfigureHelpdesk controller (CWE-306, missing authentication for critical function). An unauthenticated remote attacker can submit crafted requests to these endpoints to repoint the application's database connection and create a new super administrator account. With a super admin account (and possibly control of the datastore), the attacker gains full control of the helpdesk instance, including tickets, customer data, and further access into the hosting environment. Any organization running a self-hosted UVdesk Community Skeleton instance at version 1.1.8 or earlier is affected, particularly instances reachable from the internet. As of this analysis there is no public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild, but the flaw is trivially exploitable with simple HTTP requests, so attackers could weaponize it quickly once disclosed.

What to do: Upgrade UVdesk Community Skeleton to a version newer than 1.1.8 as soon as a patched release is available, and until then block or require authentication for the installer/wizard routes (ConfigureHelpdesk controller endpoints) at the web server or reverse proxy. Review application logs for unauthenticated POST requests to wizard/installer paths, check the configuration for unexpected database host changes, and audit member/admin accounts for super administrators you did not create. If a rogue super admin or altered database configuration is found, rotate all credentials and treat tickets and stored data as compromised.