Uvdesk Core-framework vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Uvdesk Core-framework: 3 record(s), with affected versions and fixes.

CVE-2025-71421 High · 7.2 CWE-269 Sep 21, 2026

UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.

CVE-2025-71420 Medium · 4.3 CWE-639 Sep 21, 2026

UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

CVE-2025-71419 Medium · 5.4 CWE-79 Sep 21, 2026

UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.