CVE-2026-105029CWE-639

CVE-2026-105029

Medium · published October 3, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00200 · 9.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-03T04:16Z
References (5)
https://github.com/uvdesk/support-center-bundle · [email protected]https://github.com/uvdesk/support-center-bundle/commit/3fa884a3adf0f317f354f83a1f9fa531234a551f · [email protected]https://hackmd.io/@leediay/idor-rate-ticket_uvdesk · [email protected]https://www.vulncheck.com/advisories/uvdesk-support-center-bundle-before-1.1.3.3-idor-via-rateticket-ticket-rating-endpoint · [email protected]https://hackmd.io/@leediay/idor-rate-ticket_uvdesk · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 02 OCT 23:28Z
    UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint
    cvelistv5