CVE-2022-45180: Liveboxcloud Vdesk

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdesk_{DOMAIN]/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system (an operation intended to only be available to the system administrator).

Affected products

• Liveboxcloud Vdesk: up to and including 018

Published 2023-04-14. Last modified 2026-06-17.