Quick answers
- Is CVE-2025-71420 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-71420 being exploited in the wild.
- How severe is CVE-2025-71420?
- Medium severity, with a CVSS score of 4.3, published 21 September 2026.
- Which products and versions are affected?
- UVdesk Core-Framework before 1.1.8.
- Is there a fix for CVE-2025-71420?
- A patch was published on 2025-09-19: patch released in v1.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-71420 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-71420?
- Check whether you run UVdesk Core-Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass in the saved reply endpoint that fails to properly validate whether an authenticated agent has permission to access replies restricted to other support groups. An attacker with ROLE_AGENT can enumerate saved reply identifiers through the endpoint and read content they are not authorized to access, without requiring additional privileges or user interaction. The fix is available in version 1.1.8 and later.
Affected products
- UVdesk core-framework before 1.1.8
Timeline
- 2025-09-21: disclosed
- 2025-09-19: patched: patch released in v1.1.8