Privilege escalation in Uvdesk Community-Skeleton
CVE-2025-71421
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (50.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002
Affected products
Weakness classification (CWE)
References
- github.com/uvdesk/core-framework/commit/b8bcdc503659f9d5c5cd73627cfc5d45508b9a55 (patch)
- github.com/uvdesk/core-framework/blob/v1.1.6/Controller/Account.php (technical-description)
- hackmd.io/@leediay/B1Cz5voFGg (third-party-advisory)
- github.com/uvdesk/core-framework/releases/tag/v1.1.7 (release-notes)
- github.com/uvdesk/community-skeleton/releases/tag/v1.1.8 (release-notes)
- github.com/uvdesk/core-framework (product)
- www.vulncheck.com/advisories/uvdesk-core-framework-before-1.1.7-privilege-escal… (third-party-advisory)
Frequently asked questions
- What is CVE-2025-71421?
- CVE-2025-71421 is a high-severity vulnerability in Uvdesk Community-Skeleton, classified under Improper Privilege Management. CVSS score: 7.2/10. Published 2026-09-21.
- How severe is CVE-2025-71421?
- High severity. CVSS v3 base score is 7.2 out of 10.