CVE-2026-92805 json
UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
published 2026-09-16 53 d ago modified 2026-09-22 47 d ago also EUVD-2026-81065
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 51 d ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- uvdesk community-skeleton
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
github.com
/uvdesk/community-skeleton/issues/926
issue-tracking
-
github.com
/uvdesk/community-skeleton
product
-
github.com
/uvdesk/community-skeleton/blob/6f35040/src/Resources/config/routes.yaml#L1-L35
technical-description
-
vulncheck.com
/advisories/uvdesk-community-skeleton-through-1.1.8-missing-authentication-on-the-installation-wizard
third-party-advisory
Sources
- CVE List CVE-2026-92805
- NVD CVE-2026-92805
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.