All vulnerabilities
CVE-2026-105029

UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint

uvdesk support-center-bundle
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.1.3.3Also 1.1.8CVE List
Published2 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.

Text from CVE List

Affected versions 4

  • support-center-bundleaffected: all versions before 1.1.3.3CVE List
  • support-center-bundleunaffected: 1.1.3.3CVE List
  • community-skeletonaffected: all versions before 1.1.8CVE List
  • community-skeletonunaffected: 1.1.8CVE List

References 4