Uvdesk vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Uvdesk products: 4 record(s), with severity, exploitation and fixes.

Community-skeleton 4 Core-framework 3 Support-center-bundle 1

Exploited only (KEV) →

CVE-2026-105029 Medium · 4.3 CWE-639 Oct 2, 2026

UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.

CVE-2025-71421 High · 7.2 CWE-269 Sep 21, 2026

UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.

CVE-2025-71420 Medium · 4.3 CWE-639 Sep 21, 2026

UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

CVE-2025-71419 Medium · 5.4 CWE-79 Sep 21, 2026

UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.