CVE-2022-45178: Liveboxcloud Vdesk

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A malicious user (already logged in as a SAML User) is able to achieve privilege escalation from a low-privilege user (FGM user) to an administrative user (GGU user), including the administrator, or create new users even without an admin role.

Affected products

• Liveboxcloud Vdesk: up to and including 018

Published 2023-04-14. Last modified 2026-06-17.