CVE-2026-92805CWE-306

CVE-2026-92805

Critical · published September 17, 2026

CVSS v3.1

9.8

EPSS

Percentile

50.1

In the wild

Unconfirmed

What it is

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00641 · 50.1th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-09-17T01:17Z

References (4)

https://github.com/uvdesk/community-skeleton · [email protected]https://github.com/uvdesk/community-skeleton/blob/6f35040/src/Resources/config/routes.yaml#L1-L35 · [email protected]https://github.com/uvdesk/community-skeleton/issues/926 · [email protected]https://www.vulncheck.com/advisories/uvdesk-community-skeleton-through-1.1.8-missing-authentication-on-the-installation-wizard · [email protected]

EPSS history

Timeline

18 SEP 04:02Z
EPSS moved — → 0%
epss
16 SEP 20:32Z
UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
cvelistv5