CVE-2025-71421 — UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escala…
Published: 2026-09-21 · CVSS: 8.6 · CVSS 4.0
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7