A critical authentication bypass in UVdesk Community Skeleton allows unauthenticated remote attackers to gain full administrative control over the affected instance.

This vulnerability is a missing authentication flaw (CWE-306) affecting multiple wizard endpoints within the ConfigureHelpdesk controller. Unauthenticated attackers can interact with these POST endpoints, such as /wizard/xhr/load/super-user, to modify database configurations and create new administrative users.

The potential for unauthorized creation of super administrator accounts represents a total compromise of the helpdesk application. With a CVSS score of 9.8, this flaw poses an extreme risk, as it allows attackers to gain full control over the instance, leading to complete data exfiltration, service manipulation, and long term persistence within the organization.

Immediate Action: As no specific patch version is currently identified, administrators should immediately restrict network access to the installation wizard endpoints (starting with /wizard/xhr/) to trusted IP addresses only.

Proactive Monitoring: Security teams should audit web server access logs for any POST requests directed to /wizard/xhr/ endpoints, particularly those originating from external or unauthorized network ranges.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or challenge all requests to the /wizard/xhr/ path, as this effectively prevents access to the vulnerable controller actions.

Public Exploit Available: Unknown

Given the critical severity of this vulnerability and the lack of a confirmed patch, immediate mitigation is required to prevent unauthorized administrative access. Administrators must prioritize blocking access to the affected wizard endpoints at the network or application firewall level until the vendor releases a secure update.