CVE-2025-71420: Uvdesk Community-Skeleton

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

Affected products

• Uvdesk Community-Skeleton: before 1.1.8 (fixed in 1.1.8)
• Uvdesk Core-Framework: before 1.1.7 (fixed in 1.1.7)

Published 2026-09-21. Last modified 2026-09-22.