Which versions of UVdesk core-framework are affected by EUVD-2025-210977?

A privilege-escalation flaw in UVdesk's core-framework lets helpdesk staff who hold delegated agent-management rights promote their own account to full administrator, giving them control over the…. A patch is available.

How to fix or mitigate EUVD-2025-210977?

Within 24 hours, inventory every UVdesk core-framework deployment and identify which ones grant agent-management privileges to non-administrator accounts, since those are the only environments where this issue is exploitable; where such delegation exists, immediately remove or tightly restrict that privilege and review recent editAgent activity for any role changes to ROLE_ADMIN. Within 7 days, upgrade all affected instances to UVdesk core-framework 1.1.7 or later (the vendor-released patch), validate the change in a staging tenant before production rollout, and re-audit agent role assignments to detect any unexpected administrator accounts created while the vulnerable version was running. Within 30 days, add monitoring and alerting on role-change operations against the editAgent endpoint, enforce least privilege so agent-management rights are no longer broadly delegated, and fold version 1.1.7 or later into your standard build image and patch baseline so newly deployed tenants are not shipped vulnerable.

UVdesk core-framework EUVD-2025-210977

Q: What is the CVSS score of EUVD-2025-210977?

EUVD-2025-210977 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2025-71421 HIGH

Improper Privilege Management (CWE-269)

2026-09-21 VulnCheck

GHSA-hvr3-jhx6-xw68

PHP Privilege Escalation Community Skeleton Uvdesk Core Framework

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

PR:H because the attacker must already hold agent-management privilege; network-reachable HTTP endpoint with low complexity and no user interaction; escalation to admin gives full C/I/A over the application, scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 21, 2026 - 14:40 vuln.today

tag: PHP added

Analysis Generated

Sep 21, 2026 - 14:37 vuln.today

CVE Published

Sep 21, 2026 - 13:43 cve.org

HIGH 8.6

DescriptionCVE.org

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 1 Critical, 5 High Severity, 1 With POC Sep 22, 2026

AnalysisAI

Privilege escalation in UVdesk core-framework before 1.1.7 lets an authenticated agent who already holds the agent-management privilege promote their own account to ROLE_ADMIN through the editAgent endpoint, gaining full administrative control over agents, tickets and mail configuration. The attacker simply submits their own account identifier together with a role parameter set to ROLE_ADMIN, so the flaw converts a delegated helpdesk-management role into complete tenant takeover. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is only practical in deployments that grant agent-management rights to non-administrators.

Technical ContextAI

UVdesk is a PHP helpdesk/customer-support platform built on the Symfony framework (the affected component is the core-framework bundle, normally deployed through the community-skeleton distribution). The root cause is CWE-269, Improper Privilege Management: the editAgent action in Controller/Account.php (around lines 278-282 in v1.1.6) accepted a user-supplied 'role' field and applied it to the account identified in the request without verifying whether the acting user was modifying their own record. Because agents with agent-management capability could target their own identifier, a request carrying role=ROLE_ADMIN was processed and written, escalating the caller from ROLE_AGENT to ROLE_ADMIN. UVdesk's role model distinguishes ROLE_AGENT, ROLE_ADMIN and ROLE_SUPER_ADMIN, so reaching administrator level exposes agent administration, ticket data and mail/transport configuration. The upstream fix (commit b8bcdc503659f9d5c5cd73627cfc5d45508b9a55) adds an explicit guard that returns HTTP 403 with the message 'Warning ! You are not allowed to change your role.' when a user supplies a role parameter for their own account; the same release also corrects a super-admin deletion check in Controller/AccountXHR.php.

RemediationAI

Vendor-released patch: UVdesk core-framework 1.1.7 (and community-skeleton 1.1.8 for the packaged distribution) - upgrade to these versions or later, which apply the editAgent role-change guard from commit https://github.com/uvdesk/core-framework/commit/b8bcdc503659f9d5c5cd73627cfc5d45508b9a55; the v1.1.6 vulnerable code can be reviewed at https://github.com/uvdesk/core-framework/blob/v1.1.6/Controller/Account.php#L278-L282 and release artifacts are listed at https://github.com/uvdesk/core-framework/releases/tag/v1.1.7 and https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8. If upgrading immediately is not possible, the effective compensating control is to strip the agent-management privilege from every non-administrator account and reserve it for trusted administrators only (trade-off: loss of delegated agent administration and possible disruption to helpdesk onboarding workflows); additionally audit the agent roster for unexpected ROLE_ADMIN assignments and review logs for editAgent or role-parameter submissions against a caller's own account identifier, since any such event on a patched-unaware instance should be treated as a potential compromise. Because the flaw requires only a single authenticated request, restricting or blocking the editAgent action at the reverse proxy for non-admin sessions is a viable stopgap, but it will break legitimate agent editing performed by those users. Full administrative access obtained through this path also justifies credential rotation for affected agents and a review of mail configuration, since those settings are exposed to ROLE_ADMIN.