CVE-2025-71421: Uvdesk Community-Skeleton

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.

Affected products

• Uvdesk Community-Skeleton: before 1.1.8 (fixed in 1.1.8)
• Uvdesk Core-Framework: before 1.1.7 (fixed in 1.1.7)

Published 2026-09-21. Last modified 2026-09-22.