CVE-2026-92805 Details

A vulnerability exists in UVdesk Community Skeleton versions through 1.1.8, where the installation wizard endpoints lack proper authentication and validation. This flaw enables unauthenticated attackers to manipulate database settings and create super administrator accounts. The vulnerability arises from the absence of authentication on critical wizard endpoints, allowing attackers to gain full control over the application by submitting crafted requests. Exploitation involves sending unauthorized requests to database verification and configuration endpoints, ultimately leading to the creation of a super administrator account with elevated privileges.

To address this vulnerability, it is recommended to add authentication requirements to the wizard endpoints and implement a validation check to ensure that the installation process is only carried out when a super administrator account does not already exist. Additionally, consider requiring a deployment-time installation token to prevent unauthorized access to the wizard routes.