Authentication Bypass in UVdesk Community Skeleton by UVdesk
CVE-2026-92805

9.3CRITICAL

Key Information:

Vendor

Uvdesk

Status
Community-skeleton
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92805?

The UVdesk Community Skeleton up to version 1.1.8 has a significant security vulnerability due to inadequate authentication mechanisms on its wizard endpoints located in the ConfigureHelpdesk controller actions. Attackers who have no authentication can exploit this flaw to manipulate the database, resulting in the ability to create unauthorized super administrator accounts. This jeopardizes the entire instance, allowing full control over the system without proper permissions.

Affected Version(s)

community-skeleton 0 <= 1.1.8

References

https://github.com/uvdesk/community-skeleton/issues/926
issue-tracking
https://github.com/uvdesk/community-skeleton
product
https://github.com/uvdesk/community-skeleton/blob/6f35040...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.