UVdesk Community Skeleton <= v1.1.8 Vulnerability: Critical Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- uvdesk community skeleton (npm)
- Affected versions
- >= v1.1.8, <= v1.1.8
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in UVdesk Community Skeleton version 1.1.8. This issue allows unauthenticated attackers to gain full control of the instance.
What happened
An early warning has been issued for a critical vulnerability in UVdesk Community Skeleton version 1.1.8. The vulnerability, tracked as CVE-2026-92805, allows unauthenticated attackers to gain full control of the instance. This is achieved by submitting crafted requests to wizard endpoints in the ConfigureHelpdesk controller actions, which fail to authenticate or validate the installation state. Attackers can repoint the database and create super administrator accounts, leading to complete compromise of the affected instance.
The vulnerability was first flagged on September 16, 2026. It has a CVSS score of 9.8, indicating its critical severity. There are no reports of this vulnerability being exploited in the wild at this time. The issue is specific to UVdesk Community Skeleton version 1.1.8 and has not been confirmed in other versions.
What to do about it
- Upgrade UVdesk Community Skeleton to a version beyond 1.1.8 as soon as possible.
- Review all accounts for any signs of compromise, particularly super administrator accounts.
- Monitor the primary sources for updates on this vulnerability.
- Implement additional security measures to protect your instance while the upgrade is being performed.
How 0Day would have caught this
uvdesk community skeleton is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using UVdesk Community Skeleton version 1.1.8.
What should I do right now?
Upgrade to a version beyond 1.1.8 and review any potentially compromised accounts.
Has this vulnerability been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.
Where can I find more information about this vulnerability?
Consult the primary sources provided, including the NVD entry for CVE-2026-92805.