Is there a patch available for CVE-2025-71420?

Yes, a patch is available for CVE-2025-71420. Update the affected software to the latest version immediately.

UVdesk Helpdesk CVE-2025-71420

Q: What is the CVSS score of CVE-2025-71420?

CVE-2025-71420 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210976 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-09-21 VulnCheck

GHSA-gvmp-wwrp-jm4j

PHP Authentication Bypass Community Skeleton Uvdesk Core Framework

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Authenticated agent (PR:L) over the network with low complexity gains read-only cross-group disclosure of saved-reply content, so C:L and I/A:N; scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 21, 2026 - 14:40 vuln.today

tag: PHP added

Analysis Generated

Sep 21, 2026 - 14:38 vuln.today

DescriptionCVE.org

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

AnalysisAI

Authorization bypass in UVdesk's saved-reply endpoints lets an authenticated agent holding only ROLE_AGENT enumerate saved reply identifiers and read template content reserved for support groups and teams they do not belong to. Exploitation requires a valid low-privilege agent session and network reachability to the loadTicketSavedReplies / getSavedReplyContent XHR endpoints, and yields read-only exposure of saved-reply text with no integrity or availability impact; UVdesk core-framework versions before 1.1.7 (bundled in community-skeleton before 1.1.8) are affected. No confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis - this is a genuine but modest-severity information-disclosure flaw rather than an urgent priority.

Technical ContextAI

UVdesk is a Symfony/PHP-based helpdesk platform, and the flaw is a classic CWE-639 authorization bypass through a user-controlled key, i.e. an insecure direct object reference. The server-side logic in Services/TicketService.php::getSavedReplyContent($savedReplyId, $ticketId) resolved a saved reply purely by the identifier supplied by the client and returned its rendered content without verifying that the requesting agent shared a support group or support team with that saved reply; the XHR wrapper Controller/TicketXHR.php::loadTicketSavedReplies then surfaced that content directly in the JSON response. Because the identifiers are sequential/enumerable and the listing helper getSavedReplies() only narrowed visibility for group-scoped replies, any agent account with ROLE_AGENT could request reply IDs outside its own scope and receive the template body. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects the need for a valid low-privilege session and confirms confidentiality-only impact; the vendor's 1.1.7 commit (de0422869708eb17a54bf6a98166abb80c0d483d) fixes this by short-circuiting filtering for ROLE_SUPER_ADMIN/ROLE_ADMIN, mapping the saved reply's supportGroups/supportTeams IDs against the current agent's memberships, adding role checks in Controller/SavedReplies.php, and wrapping the content lookup in a try/catch that returns an alert payload on denial. The affected CPEs cpe:2.3:a:uvdesk:core-framework:*:*:*:*:*:*:*:* and cpe:2.3:a:uvdesk:community-skeleton:*:*:*:*:*:*:*:* confirm the core framework and its distribution skeleton are both in scope.

RemediationAI

Vendor-released patch: UVdesk core-framework v1.1.7 (upstream fix commit https://github.com/uvdesk/core-framework/commit/de0422869708eb17a54bf6a98166abb80c0d483d) and community-skeleton v1.1.8 (https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8); administrators should upgrade the core framework to 1.1.7 or later and the community skeleton to 1.1.8 or later, then clear the application cache and re-run migrations. Because the patch is applied at the service layer, upgrade the framework package itself rather than relying on theme or bundle updates. Until upgrading, compensating controls include restricting group/team-scoped saved replies so that no template carries a support group or support team assignment narrower than the agent population (this removes the sensitive data at risk but degrades the multi-team workflow), limiting ROLE_AGENT account provisioning and auditing agent accounts, and fronting the helpdesk with a reverse proxy that logs and rate-limits requests to the loadTicketSavedReplies XHR endpoint so sequential identifier enumeration is detectable - noting that such monitoring is detective only and does not prevent the read. After patching, validate that admin and super-admin roles retain their intended unrestricted saved-reply visibility, since the fix intentionally preserves that behavior.