CVE-2026-105029: UVdesk Auth Bypass Vulnerability

CVE-2026-105029 Overview

CVE-2026-105029 is an Insecure Direct Object Reference (IDOR) vulnerability in the UVdesk support-center-bundle prior to version 1.1.3.3. The flaw resides in the rateTicket action of Controller/Ticket.php, where the application loads tickets by ID without verifying that the authenticated customer owns the ticket. Any authenticated customer can submit or modify satisfaction ratings on tickets belonging to other customers by supplying arbitrary ticket IDs. The issue is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated customers can tamper with the integrity of satisfaction ratings across the entire helpdesk, distorting agent performance metrics and customer feedback data.

Affected Products

UVdesk support-center-bundle versions prior to 1.1.3.3
Helpdesk deployments exposing the customer rating endpoint to authenticated users
UVdesk Community Skeleton installations bundling the vulnerable Symfony bundle

Discovery Timeline

2026-10-03 - CVE-2026-105029 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105029

Vulnerability Analysis

UVdesk is an open-source Symfony-based helpdesk framework. The support-center-bundle provides the customer-facing portal, including ticket viewing and satisfaction rating. The rateTicket action in Controller/Ticket.php accepts a ticket identifier from the request and loads the matching ticket entity directly from the ORM repository.

The action then persists a rating value against the loaded ticket. Because no authorization check validates that the current session's customer matches the ticket's customer relationship, the request completes successfully regardless of ownership. An attacker only needs a valid customer account on the target UVdesk instance to invoke the endpoint against arbitrary ticket IDs.

Root Cause

The root cause is a missing ownership check between the authenticated principal and the target ticket entity. The controller trusts the ticket ID supplied in the request and resolves it through the repository without comparing the ticket's owner to the session's customer. This matches the [CWE-639] pattern, where authorization decisions depend on a user-controlled key that is not validated.

Attack Vector

Exploitation requires a valid customer account and network access to the helpdesk portal. The attacker enumerates ticket IDs through sequential or guessed values and issues rateTicket requests referencing those IDs. The server records the attacker-supplied rating against each targeted ticket. The attack does not require user interaction from the victim and does not expose confidential ticket data, but it corrupts rating integrity for arbitrary customers and agents.

php

     {
         $this->isWebsiteActive();
 
-        $thread = null;
         $formErrors = $errors = array();
         $website = $this->em->getRepository(CoreEntities\Website::class)->findOneByCode('knowledgebase');
         $websiteConfiguration = $this->uvdeskService->getActiveConfiguration($website->getId());

Source: GitHub Commit 3fa884a. The upstream patch modifies Controller/Ticket.php to add ownership enforcement before the rating is persisted.

Detection Methods for CVE-2026-105029

Indicators of Compromise

HTTP requests to the UVdesk rateTicket route from a customer session referencing ticket IDs the customer never opened or interacted with
Satisfaction rating records (ticket_rating or equivalent table) created or modified by customer_id values that do not match the related ticket.customer_id
Bursts of sequential ticket ID access from a single authenticated session, consistent with ID enumeration

Detection Strategies

Review web server access logs for POST requests to the ticket rating endpoint and correlate the submitting customer with the ticket owner recorded in the database
Query the UVdesk database for rows where the rating author differs from the ticket's owning customer, which should not occur under normal use
Add application-layer logging in Controller/Ticket.php to emit the authenticated customer ID and target ticket ID for every rateTicket invocation

Monitoring Recommendations

Alert on any single customer session issuing rating requests across more than a small threshold of distinct ticket IDs within a short window
Monitor for sudden shifts in aggregated satisfaction metrics that do not align with ticket volume or agent activity
Forward UVdesk application and web server logs to a centralized analytics platform for retention and correlation across sessions

How to Mitigate CVE-2026-105029

Immediate Actions Required

Upgrade uvdesk/support-center-bundle to version 1.1.3.3 or later using Composer
Audit historical rating data and roll back or flag ratings submitted by customers who are not the ticket owner
Rotate credentials for customer accounts exhibiting enumeration patterns and review associated session activity

Patch Information

The fix is delivered in commit 3fa884a on the UVdesk support-center-bundle repository, released as part of version 1.1.3.3. Additional context is available in the VulnCheck Advisory for UVDesk and the HackMD IDOR Analysis.

Workarounds

Place a reverse proxy or web application firewall rule in front of the rateTicket endpoint and enforce rate limiting per authenticated session
Temporarily disable the customer rating feature in the portal configuration if an immediate upgrade is not feasible
Apply a local patch to Controller/Ticket.php that compares the loaded ticket's customer ID with the authenticated session's customer ID and returns HTTP 403 on mismatch

bash

# Upgrade the vulnerable bundle to the fixed release
composer require uvdesk/support-center-bundle:^1.1.3.3
composer update uvdesk/support-center-bundle
php bin/console cache:clear --env=prod