Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-105029: UVdesk support-center-bundle lets customers change others' ticket ratings
CVE-2026-105029 · published 1 month ago
Summary
The UVdesk support-center-bundle (and the community‑skeleton that includes it) lets a logged‑in customer submit or modify satisfaction ratings on tickets they do not own. This could let people influence feedback on other users' support cases. Upgrade to version 1.1.3.3 or later, or apply a patch that checks ticket ownership before allowing a rating.
What to do
- Update uvdesk support-center-bundle to version 1.1.3.3 or later.
- Update uvdesk community-skeleton to version 1.1.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| uvdesk | support-center-bundle | < 1.1.3.3 |
| uvdesk | community-skeleton | < 1.1.8 |
Original advisory text
UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.
References
- https://github.com/uvdesk/support-center-bundle/commit/3fa884a3adf0f317f354f83a1... Patch
- https://github.com/uvdesk/support-center-bundle Product
- https://hackmd.io/@leediay/idor-rate-ticket_uvdesk Third Party Advisory
- https://www.vulncheck.com/advisories/uvdesk-support-center-bundle-before-1.1.3.3... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1050... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105029 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published2 Oct 2026
Updated4 Nov 2026
First seen2 Oct 2026
Track software like this
Free during beta