EUVD-2026-91856
GHSA-vqxj-p9x3-9jmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any customer
-
ExploitSupply arbitrary ticket ID to rateTicket endpoint
-
ExecutionBypass missing ownership check
-
ImpactSubmit or overwrite satisfaction ratings on others' tickets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated customer account on the UVdesk support-center portal (PR:L). The attacker must supply or enumerate ticket IDs owned by other customers; because the vulnerable rateTicket action called find($id) without a customer filter, any supplied ID is loaded without an ownership check. Exploitation is limited to submitting or altering satisfaction ratings - it grants no read access to ticket content and no code execution. Only support-center-bundle versions before 1.1.3.3 are affected; patched builds reject tickets not owned by the requesting customer with an 'Invalid rating' response. |
| Impact | This is a medium-severity authorization flaw (CWE-639 IDOR), not a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms a network-reachable, low-complexity endpoint but requires an authenticated customer account (PR:L), and the only impact is low integrity (VI:L) - tampering with satisfaction ratings - with no confidentiality (VC:N) or availability (VA:N) impact. No EPSS score, SSVC decision, or KEV status was provided in the input, so there is no signal of widespread or automatable exploitation; KEV is absent, meaning no confirmed active exploitation. A public technical writeup exists (hackmd.io/@leediay/idor-rate-ticket_uvdesk) and the fixing commit is public, so exploitation details are available, but no formal POC=YES flag was supplied. The signals are internally consistent: the flaw is genuine and trivially exploitable by any logged-in customer, but its real-world blast radius is small because it only affects the integrity of ticket satisfaction ratings, not the tickets' content or the system itself. Net: a legitimate low-to-medium data-integrity bug worth patching, not an emergency. |
| Exploit ScenarioDerived | A registered customer on a UVdesk support portal logs in and sends a rateTicket request supplying a ticket ID belonging to a different customer. Because the endpoint loaded the ticket by ID alone without an ownership check, the attacker's rating is accepted, letting them submit or overwrite satisfaction ratings on tickets they do not own. A public technical writeup detailing this IDOR is available, lowering the skill needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
An insecure direct object reference (IDOR) in the UVdesk support-center-bundle before version 1.1.3.3 lets any authenticated customer submit or overwrite the satisfaction rating on tickets owned by other customers by supplying arbitrary ticket IDs to the rateTicket action. The flaw is limited to rating tampering: it grants no read access to other customers' ticket content, no account takeover, and no code execution, which is why it is assessed as medium severity (CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Exploitation requires a valid, low-privileged customer account and knowledge or enumeration of target ticket IDs; no public exploit code was identified at time of analysis, and the issue is fixed upstream in 1.1.3.3.
RemediationAI
Upgrade the UVdesk support-center-bundle to 1.1.3.3 or later - the tagged maintenance release referenced by the vendor changelog - or apply the upstream patch commit 3fa884a3adf0f317f354f83a1f9fa531234a551f, which changes the rateTicket lookup from find($id) to findOneBy(['id' => $id, 'customer' => $customer]) and rejects foreign tickets with an 'Invalid rating' response; note that patch status is confirmed at the commit/release level rather than through an independent vendor security bulletin. If upgrading is not immediately possible, compensating controls include temporarily disabling or removing the customer-facing ticket rating route so the rateTicket endpoint is unreachable, which eliminates the attack surface at the cost of losing satisfaction survey data collection, or fronting the helpdesk with a reverse-proxy/WAF rule that restricts POSTs to the rating endpoint to same-session ticket IDs - an effective but brittle filter that can be bypassed if IDs are legitimately shared. Additional context is available in the VulnCheck advisory (https://www.vulncheck.com/advisories/uvdesk-support-center-bundle-before-1.1.3.3-idor-via-rateticket-ticket-rating-endpoint) and the reporter's write-up (https://hackmd.io/@leediay/idor-rate-ticket_uvdesk).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The support-center-bundle is the Symfony/PHP customer-facing helpdesk component of UVdesk, routing ticket creation, replies and satisfaction ratings through Controller/Ticket.php. The vulnerable rateTicket() action resolved the target ticket with Doctrine's $repository->find($id), which loads a Ticket entity by primary key alone and performs no ownership or authorization filtering. Because the object reference (the ticket ID) is attacker-controlled and the loaded entity is trusted implicitly, any authenticated customer could reference another customer's ticket and write a rating to it - the classic CWE-639 Authorization Bypass Through User-Controlled Key pattern. The upstream fix replaces the bare lookup with findOneBy(['id' => $id, 'customer' => $customer]) and returns an 'Invalid rating' JSON error when no ticket matching both the ID and the requesting customer is found, scoping the write to objects the caller actually owns. The same commit also removes broad try/catch blocks around ticket and thread creation and narrows an htmlspecialchars/str_replace sanitization call, none of which change the rating authorization behavior but indicate a broader hardening pass in the 1.1.3.x line.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated customer account required (PR:L) over a network-reachable, low-complexity endpoint; impact is limited to tampering with ratings (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB