A reported missing authentication flaw in UVdesk Community Skeleton through version 1.1.8 would let unauthenticated attackers hijack the installation wizard, repoint the database, and mint super administrator accounts; full control of the helpdesk instance, scored CVSS 9.8 Critical. The description below reflects a single CNA advisory; no public proof-of-concept or independent confirmation of the chain is available.
What Is It
According to the VulnCheck advisory, UVdesk Community Skeleton fails to authenticate or validate installation state on the wizard endpoints exposed by ConfigureHelpdesk controller actions. The advisory states those endpoints remain reachable after setup is complete and do not check who is calling them.
As described, an attacker who can reach the application over the network submits crafted requests to the wizard endpoints. From there they would be able to repoint the database the instance uses and create super administrator accounts, gaining full control of the instance; with no credentials, no user interaction, and no special conditions required. The end-to-end chain has not been demonstrated publicly, so the practical exploitability of each step rests on the advisory's account rather than on reproduced results.
The weakness is classified as CWE-306 (Missing Authentication for Critical Function). VulnCheck assigned CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.3, both Critical, with High impact to confidentiality, integrity, and availability. Those scores are the CNA's own assessment and have not been adjusted by NVD analysts.
Why It Matters
If the chain works as described, this is the cheapest class of compromise there is: network-reachable, low complexity, zero privileges, zero interaction. A helpdesk platform holds customer correspondence, ticket history, attachments, and agent accounts, and an attacker who creates their own super admin owns all of it. Repointing the database would also mean the attacker can swap the backing store entirely, turning the application into infrastructure they control.
The CISA Known Exploited Vulnerabilities Catalog has no entry for this CVE as of 2026-09-16, so there is no confirmed active exploitation on record at this time. The exploit maturity field in the CVSS v4.0 vector is Not Defined. Absence of a KEV listing is not reassurance for a pre-auth admin-creation bug in an internet-facing product, but neither the absence of a KEV entry nor the presence of a Critical CNA score settles whether the flaw is practically exploitable in a given deployment.
What's Vulnerable
- Vendor: uvdesk
- Product: community-skeleton (
pkg:composer/uvdesk/community-skeleton) - Affected versions: all versions through 1.1.8 (semver,
<= 1.1.8) per the advisory - Default status: all other versions listed as unaffected
No CPE entries were published with this record. The affected-version range comes from the CNA submission and has not been independently verified against the upstream release history.
Patch Status
The NVD record is in Received status as of its publication on 2026-09-16 and lists no patch reference or fixed version. No vendor remediation or CISA required action is present in the supplied data, and there is no vendor statement confirming or disputing the advisory's findings. Operators should treat the wizard endpoints as the exposure and restrict network access to them pending vendor guidance; the upstream issue tracker (#926) is the place to watch for a fix or for vendor comment on the report.
Sources
- NVD, CVE-2026-92805 record (source: [email protected], published 2026-09-16)
- VulnCheck Advisory, UVdesk Community Skeleton through 1.1.8: Missing Authentication on the Installation Wizard
- CISA, Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-92805 as of 2026-09-16)
- UVdesk Community Skeleton, GitHub repository
- UVdesk Community Skeleton, routes.yaml (commit 6f35040, L1-35)
- UVdesk Community Skeleton, Issue #926