Executive brief
UVdesk Community Skeleton is an open-source helpdesk ticketing system. Versions through 1.1.8 fail to protect installation wizard endpoints from unauthorized access, allowing unauthenticated attackers to reconfigure the application's database connection and create administrator accounts without any credentials. An attacker can exploit this to seize complete control of a running helpdesk instance, access customer support data, and modify configurations.
Technical details
The vulnerability is an authentication bypass in the ConfigureHelpdesk controller's wizard endpoints (paths like /wizard/xhr/*). These endpoints are intended to be used only during initial installation but lack proper authentication or installation-state validation. An attacker can send crafted POST requests to endpoints such as verifyDatabaseCredentials and createDefaultSuperUserXHR to reconfigure database connections and create super-admin accounts. The attack requires network access to the application but no prior authentication. A successful exploit grants full administrative control, including data access and system configuration changes.
Affected products
- UVdesk Community Skeleton through 1.1.8
Timeline
- 2026-09-16: disclosed