The vulnerability CVE-2025-71421 affects UVdesk core-framework versions prior to 1.1.7. It is caused by improper privilege management in the editAgent endpoint. Agents who have agent-management privileges can exploit this flaw by submitting their own account identifier along with a role parameter set to ROLE_ADMIN. This results in privilege escalation, granting the attacker full administrative rights over agents, tickets, and mail configuration within the system. The CVSS 4.0 score is 8.6, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with agent-management privileges to escalate their role to administrator, gaining full control over agent accounts, ticket management, and mail configuration. This could lead to unauthorized access, modification, or disruption of critical system functions and sensitive data.

A fix is available in UVdesk core-framework version 1.1.7 and later. Users should upgrade to version 1.1.7 or higher to remediate this vulnerability. No vendor advisory content was provided to indicate otherwise.