Critical severity9.8NVD Advisory· Published Sep 16, 2026

CVE-2026-92805

Description

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Uvdesk/Community Skeletonreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.1.8

Patches

Vulnerability mechanics

References

github.com/uvdesk/community-skeleton/blob/6f35040/src/Resources/config/routes.yamlnvd
github.com/uvdesk/community-skeleton/issues/926nvd
www.vulncheck.com/advisories/uvdesk-community-skeleton-through-1.1.8-missing-authentication-on-the-installation-wizardnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000