CVE-2026-105029: UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-03 · updated 2026-10-06
Weakness: CWE-639

Description

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.

Affected products

uvdesk community-skeleton: before 1.1.8 — fixed in 1.1.8
uvdesk support-center-bundle: before 1.1.3.3 — fixed in 1.1.3.3

How to fix

Upgrade to a fixed version: uvdesk community-skeleton 1.1.8; uvdesk support-center-bundle 1.1.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-105029 or the next vulnerability affects your stack