Insecure Direct Object Reference in UVdesk Support Center Bundle
CVE-2026-105029

5.3MEDIUM

Key Information:

Vendor

Uvdesk

Status
Support-center-bundle
Community-skeleton
Vendor
CVE Published:
2 October 2026

What is CVE-2026-105029?

The UVdesk support-center-bundle prior to version 1.1.3.3 is vulnerable to an insecure direct object reference in the rateTicket action within Controller/Ticket.php. This flaw allows authenticated users to exploit arbitrary ticket IDs, enabling them to rate or modify the satisfaction ratings on tickets not owned by them. Since the application does not enforce ownership checks, malicious users can manipulate other customers' ticket ratings, potentially undermining the integrity of user feedback and support services. It is crucial to upgrade to the patched version to mitigate this risk.

Affected Version(s)

community-skeleton 0 < 1.1.8

support-center-bundle 0 < 1.1.3.3

community-skeleton 1.1.8

References

https://github.com/uvdesk/support-center-bundle/commit/3f...
patch
https://hackmd.io/@leediay/idor-rate-ticket_uvdesk
technical-description
https://github.com/uvdesk/support-center-bundle
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153
.