CVE-2026-105029: UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated customer can exploit it. The attacker needs to be able to submit a ticket ID to the ticket-rating endpoint; no additional user interaction is required.
What can an attacker do with another customer's ticket ID?
They can submit or change the satisfaction rating for tickets owned by other customers. The issue affects rating integrity; the provided data does not indicate confidentiality or availability impact.
Which versions are affected?
Versions of composer/uvdesk/support-center-bundle before 1.1.3.3 are affected. Upgrade to 1.1.3.3 or later.
How can I determine whether my deployment is vulnerable?
Check the installed support-center-bundle version and whether it is earlier than 1.1.3.3. Affected code loads ticket IDs in the rateTicket action without verifying that the authenticated customer owns the ticket.