CVE-2025-71420
MediumCVSS 4.3Summary
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
Risk Assessment
A support agent can access saved replies belonging to other groups, potentially exposing internal communication templates or restricted information. The vulnerability only requires the ROLE_AGENT role.
Recommendation
Upgrade UVdesk core-framework to version 1.1.7 or later. Until then, restrict agent permissions and monitor access to the saved reply endpoint.
Other vulnerabilities in UVdesk core-framework
See all- CVE-2025-71421High
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
- CVE-2025-71419Medium
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
Original NVD description (English source)
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.