Threat database

UVdesk support-center-bundle versions before 1.1.3.3 contain an authorization bypass vulnerability in the rateTicket action. Authenticated customers can rate or change ratings on tickets owned by other customers by supplying arbitrary ticket IDs, due to lack of ownership verification.

UVdesk core-framework versions prior to 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. This flaw allows agents who already have agent-management privileges to escalate their own role to administrator by submitting their own account identifier with a role parameter set to ROLE_ADMIN. This grants full administrative control over agents, tickets, and mail configuration. The vulnerability has a high severity with a CVSS 4.0 score of 8.6.

UVdesk core-framework versions before 1.1.7 contain an authorization bypass vulnerability in the saved reply endpoint. This flaw allows authenticated agents with the ROLE_AGENT permission to access saved replies intended for other support groups. Attackers can enumerate saved reply identifiers and read content restricted to groups and teams they do not belong to. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

UVdesk core-framework versions prior to 1.1.7 contain a stored cross-site scripting (XSS) vulnerability in the SwiftMailer configuration identifier parameter. Attackers with the ROLE_AGENT privilege can inject malicious scripts into this parameter, which are then stored and executed when other users access the configuration update page. This vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.