Core Framework
Monthly
Privilege escalation in UVdesk core-framework before 1.1.7 lets an authenticated agent who already holds the agent-management privilege promote their own account to ROLE_ADMIN through the editAgent endpoint, gaining full administrative control over agents, tickets and mail configuration. The attacker simply submits their own account identifier together with a role parameter set to ROLE_ADMIN, so the flaw converts a delegated helpdesk-management role into complete tenant takeover. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is only practical in deployments that grant agent-management rights to non-administrators.
Authorization bypass in UVdesk's saved-reply endpoints lets an authenticated agent holding only ROLE_AGENT enumerate saved reply identifiers and read template content reserved for support groups and teams they do not belong to. Exploitation requires a valid low-privilege agent session and network reachability to the loadTicketSavedReplies / getSavedReplyContent XHR endpoints, and yields read-only exposure of saved-reply text with no integrity or availability impact; UVdesk core-framework versions before 1.1.7 (bundled in community-skeleton before 1.1.8) are affected. No confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis - this is a genuine but modest-severity information-disclosure flaw rather than an urgent priority.
Stored cross-site scripting in UVdesk core-framework before 1.1.7 (and community-skeleton before 1.1.8) allows an authenticated agent to inject malicious script into the SwiftMailer configuration identifier field, which is persisted and later executed in the browser of any member who views the SwiftMailer configuration update page. The vulnerability is second-order and not self-contained, requiring a privileged victim to navigate to the affected page, and patched versions reject non-alphanumeric identifiers. No public exploit code has been identified at time of analysis, and the issue is assessed as low-to-moderate priority due to the agent-level authentication and user-interaction prerequisites.
Privilege escalation in UVdesk core-framework before 1.1.7 lets an authenticated agent who already holds the agent-management privilege promote their own account to ROLE_ADMIN through the editAgent endpoint, gaining full administrative control over agents, tickets and mail configuration. The attacker simply submits their own account identifier together with a role parameter set to ROLE_ADMIN, so the flaw converts a delegated helpdesk-management role into complete tenant takeover. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is only practical in deployments that grant agent-management rights to non-administrators.
Authorization bypass in UVdesk's saved-reply endpoints lets an authenticated agent holding only ROLE_AGENT enumerate saved reply identifiers and read template content reserved for support groups and teams they do not belong to. Exploitation requires a valid low-privilege agent session and network reachability to the loadTicketSavedReplies / getSavedReplyContent XHR endpoints, and yields read-only exposure of saved-reply text with no integrity or availability impact; UVdesk core-framework versions before 1.1.7 (bundled in community-skeleton before 1.1.8) are affected. No confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis - this is a genuine but modest-severity information-disclosure flaw rather than an urgent priority.
Stored cross-site scripting in UVdesk core-framework before 1.1.7 (and community-skeleton before 1.1.8) allows an authenticated agent to inject malicious script into the SwiftMailer configuration identifier field, which is persisted and later executed in the browser of any member who views the SwiftMailer configuration update page. The vulnerability is second-order and not self-contained, requiring a privileged victim to navigate to the affected page, and patched versions reject non-alphanumeric identifiers. No public exploit code has been identified at time of analysis, and the issue is assessed as low-to-moderate priority due to the agent-level authentication and user-interaction prerequisites.