Privilege Escalation in UVdesk core-framework

UVdesk core-framework versions prior to 1.1.7 contain a critical improper privilege management vulnerability within the editAgent endpoint. This vulnerability allows an attacker who already possesses 'agent-management' privileges to escalate their own account role to 'ROLE_ADMIN'. By submitting a specifically crafted request to the editAgent API, an authenticated malicious agent can bypass internal access controls and modify their own authorization level. Successful exploitation grants the attacker full administrative control over the platform, including the ability to manage other agents, access sensitive ticket data, and modify mail server configurations. This flaw represents a significant risk to organizations relying on UVdesk for customer support operations, as it allows internal lateral movement and broad data access from a low-privileged account.

Impact

Successful exploitation of CVE-2025-71421 results in complete administrative compromise of the UVdesk helpdesk platform. Impacted organizations face unauthorized access to helpdesk tickets, potential exfiltration of customer data, and the ability for an attacker to modify mail configurations to intercept or redirect support communications.

Recommendation

• Patch UVdesk core-framework to version 1.1.7 or later immediately to resolve the privilege escalation vulnerability associated with CVE-2025-71421.
• Audit recent logs for the 'editAgent' endpoint to identify suspicious account modifications, specifically looking for users who have changed their own role status.
• Review all existing administrator accounts within the UVdesk dashboard to identify and revert any unauthorized role changes performed by low-privileged agents.