What’s Vulnerable › Vulnerabilities

CVE-2026-92805: UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-22
• Weakness: CWE-306

Description

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.

Affected products

• uvdesk community-skeleton: through 1.1.8

References

• https://github.com/uvdesk/community-skeleton
• https://github.com/uvdesk/community-skeleton/blob/6f35040/src/Resources/config/routes.yaml#L1-L35
• https://github.com/uvdesk/community-skeleton/issues/926
• https://www.vulncheck.com/advisories/uvdesk-community-skeleton-through-1.1.8-missing-authentication-on-the-installation-wizard

Get alerted when CVE-2026-92805 or the next vulnerability affects your stack