CVE-2025-71420

Description

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-639
Reserved: 2026-09-21
Published: 2026-09-21 13:43 UTC
Last updated: 2026-09-21 14:14 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71420.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-21 14:17:14 UTC
NVD last modified: 2026-09-21 15:17:27 UTC
NVD CVSS v3.1: 4.3 / 10 MEDIUM source: disclosure@vulncheck.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 1.4 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-210976
Assigner: VulnCheck
Published: Sep 21, 2026, 1:43:34 PM
Updated: Sep 21, 2026, 2:14:06 PM
EUVD base score (CVSS 4.0): 5.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: uvdesk
Products: community-skeleton (0 <1.1.8)

core-framework (0 <1.1.7)
Aliases: GHSA-gvmp-wwrp-jm4j

ENISA description: UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

EUVD references (8)

Affected products (2)

Vendor	Product	Versions	Platforms
uvdesk	core-framework	`0` (affected), `1.1.7` (unaffected)	—
uvdesk	community-skeleton	`0` (affected), `1.1.8` (unaffected)	—

Vendor references (8)

References embedded in the original CVE record by the assigning CNA.

Patch Commit patch
getSavedReplyContent at v1.1.6 technical-description
loadTicketSavedReplies at v1.1.6 technical-description
Reporter write-up third-party-advisory
core-framework v1.1.7 Release Notes release-notes
community-skeleton v1.1.8 Release Notes release-notes
https://github.com/uvdesk/core-framework product
VulnCheck Advisory: UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (9)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8 disclosure@vulncheck.com
https://github.com/uvdesk/core-framework disclosure@vulncheck.com
https://github.com/uvdesk/core-framework/blob/v1.1.6/Controller/TicketXHR.php#L838-L850 disclosure@vulncheck.com
https://github.com/uvdesk/core-framework/blob/v1.1.6/Services/TicketService.php#L1752-L1759 disclosure@vulncheck.com
https://github.com/uvdesk/core-framework/commit/de0422869708eb17a54bf6a98166abb80c0d483d disclosure@vulncheck.com
https://github.com/uvdesk/core-framework/releases/tag/v1.1.7 disclosure@vulncheck.com
https://hackmd.io/@leediay/B1Cz5voFGg disclosure@vulncheck.com
https://hackmd.io/@leediay/B1Cz5voFGg 134c704f-9b21-4f2e-91b3-4a467353bcc0
https://www.vulncheck.com/advisories/uvdesk-core-framework-before-1.1.7-authorization-bypass-via-saved-reply disclosure@vulncheck.com

Remediations (10)

Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE

web:docs.oracle.com

Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE Services: Java Management Release Date: August 18, 2026

2026-09-22 17:06 UTC
Pennsylvania Access To Criminal History - Home - pa

web:epatch.pa.gov

Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

2026-09-22 17:06 UTC
Conan Exiles Enhanced - September Patch 2.2.0 - Funcom Forums

web:forums.funcom.com

Greetings, Exiles! A new patch is here and this one brings a major upgrade under the hood. Today's update introduces Unreal Engine 5.8.2, bringing the game onto the latest engine version and laying the groundwork for further improvements. This patch also has Iris enabled - making further improvements to the game. Iris should help to alleviate performance bottlenecks on dedicated servers ...

2026-09-22 17:06 UTC
Across Connecticut News, Breaking News in Across Connecticut - Patch

web:patch.com

Across Connecticut Latest Headlines: Person, Dog Killed In House Fire: Officials: CT News; DEEP: As Bears Get Fat, There's a Bigger Chance For Human Conflict ; Why Your iPhone Battery Dies So Fast ...

2026-09-22 17:06 UTC
Patch 1.0.14 - Valheim

web:valheim.com

Patch Notes: Quality of Life: * Added several new keybinding options to the keyboard (Alternate dodge key, hotbar rebinding (on top of 1-8), support for rebinding radial wheel, support for removing keybinds) * Added accessibility setting to be able to toggle blocking * Add toggle to Gameplay settings to skip the intro cinematic on startup

2026-09-22 17:06 UTC
ELDEN RING Patch Notes Version 1.17 - bandainamcoent.com

web:www.bandainamcoent.com

Patch 1.17 has been released for ELDEN RING. This patch aims to bring support the Tarnished Pack DLC, scheduled for release on Friday, August 28, 2026, and to implement gameplay balance adjustments.

2026-09-22 17:06 UTC
Known Exploited Vulnerabilities Catalog - CISA

web:www.cisa.gov

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...

2026-09-22 17:06 UTC
RDS Bug September 2026: Fix Windows Server Now

web:www.it-connect.tech

Fix the September 2026 RDS bug on Windows Server with Microsoft's KIR rollback. Learn deployment steps and keep the security update installed.

2026-09-22 17:06 UTC
Oracle

web:www.oracle.com

Oracle Critical Security Patch Update Advisory - August 2026 Description. A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, mor

2026-09-22 17:06 UTC
Transmog Restrictions Removed in Patch 12.2.5 - Wowhead

web:www.wowhead.com

Blizzard is removing all transmog restrictions in Patch 12.2.5, allowing players to use any type of armour for transmog, regardless of what armour type they wear.

2026-09-22 17:06 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-71420.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71420",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:13:37.762496Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:14:06.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@leediay/B1Cz5voFGg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/uvdesk/core-framework",
          "product": "core-framework",
          "vendor": "uvdesk",
          "versions": [
            {
              "lessThan": "1.1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.1.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/uvdesk/community-skeleton",
          "product": "community-skeleton",
          "vendor": "uvdesk",
          "versions": [
            {
              "lessThan": "1.1.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.1.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:uvdesk:community-skeleton:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.1.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153"
        }
      ],
      "datePublic": "2025-06-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:43:34.312Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/uvdesk/core-framework/commit/de0422869708eb17a54bf6a98166abb80c0d483d"
        },
        {
          "name": "getSavedReplyContent at v1.1.6",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uvdesk/core-framework/blob/v1.1.6/Services/TicketService.php#L1752-L1759"
        },
        {
          "name": "loadTicketSavedReplies at v1.1.6",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uvdesk/core-framework/blob/v1.1.6/Controller/TicketXHR.php#L838-L850"
        },
        {
          "name": "Reporter write-up",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@leediay/B1Cz5voFGg"
        },
        {
          "name": "core-framework v1.1.7 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/uvdesk/core-framework/releases/tag/v1.1.7"
        },
        {
          "name": "community-skeleton v1.1.8 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uvdesk/core-framework"
        },
        {
          "name": "VulnCheck Advisory: UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/uvdesk-core-framework-before-1.1.7-authorization-bypass-via-saved-reply"
        }
      ],
      "title": "UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71420",
    "datePublished": "2026-09-21T13:43:34.312Z",
    "dateReserved": "2026-09-21T13:09:22.541Z",
    "dateUpdated": "2026-09-21T14:14:06.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}