---
id: CVE-2026-105029
title: >-
  UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object
  reference vulnerability in the rateTicket action of Controller/Ticket.php that
  allows authenticated customers to rate other customers' tickets
summary: >-
  UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object
  reference vulnerability in the rateTicket action of Controller/Ticket.php that
  allows authenticated customers to rate other customers' tickets. Attackers can
  …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-639
vendor: uvdesk
product: support-center-bundle
affected:
  - support-center-bundle < 1.1.3.3
  - community-skeleton < 1.1.8
published: '2026-10-03'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T17:17:16.577'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105029'
references:
  - url: 'https://github.com/uvdesk/support-center-bundle'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/uvdesk/support-center-bundle/commit/3fa884a3adf0f317f354f83a1f9fa531234a551f
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/idor-rate-ticket_uvdesk'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/uvdesk-support-center-bundle-before-1.1.3.3-idor-via-rateticket-ticket-rating-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/idor-rate-ticket_uvdesk'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00243
epssPercentile: 0.15389
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-06T16:44:22.158570Z'
ingestedAt: '2026-10-02T23:34:57.408Z'
---

## Overview

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.