UVdesk Community Skeleton CVE-2026-92805

The ConfigureHelpdesk wizard/installation endpoints must be network-reachable. The defining condition is what is ABSENT: the controller performs no authentication and does not validate installation state, so exploitation works against default deployments AND against instances that are already fully installed - no credentials, no user interaction, and no fresh-install window are required. The primary limiting factor is deployment hardening: instances where operators have deleted the installer/wizard directory after setup, or blocked the wizard routes at a reverse proxy/WAF, are not reachable. No special product configuration is needed to enable the flaw; it is present by default in versions 0 through 1.1.8.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) aligns cleanly with a CWE-306 missing-authentication flaw: fully remote, no privileges, no user interaction, no attack requirements, yielding complete confidentiality/integrity/availability compromise. All input signals point the same direction - no conflicting metrics. The one important nuance the vector does not capture is the description's statement that the wizard fails to validate installation state, meaning ALREADY-INSTALLED production instances (not merely fresh/unfinished installs) remain exploitable - this materially raises real-world exposure. Missing signals: no EPSS score, no CISA KEV listing, and no explicit public proof-of-concept is present in the provided references (only a GitHub issue #926 and a VulnCheck advisory). Absence of KEV/EPSS/POC lowers confidence about active exploitation but does not diminish the intrinsic severity of an unauthenticated full-takeover primitive; the low technical bar makes reliable weaponization very plausible.

An unauthenticated attacker locates an internet-exposed UVdesk instance and sends crafted requests directly to the ConfigureHelpdesk wizard endpoints, which never check authentication or whether the application is already installed. The attacker repoints the database configuration and creates a new super-administrator account, then logs in with full control of the helpdesk. No public exploit code is identified in the provided references, but the flaw requires only ordinary HTTP requests, so exploitation is straightforward.