UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-71420 · Microsoft / collected KEV context

cve-program · CVE-2025-71420

• https://github.com/uvdesk/core-framework/commit/de0422869708eb17a54bf6a98166abb80c0d483d
• https://github.com/uvdesk/core-framework/blob/v1.1.6/Services/TicketService.php#L1752-L1759
• https://github.com/uvdesk/core-framework/blob/v1.1.6/Controller/TicketXHR.php#L838-L850
• https://hackmd.io/@leediay/B1Cz5voFGg
• https://github.com/uvdesk/core-framework/releases/tag/v1.1.7
• https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8
• https://github.com/uvdesk/core-framework
• https://www.vulncheck.com/advisories/uvdesk-core-framework-before-1.1.7-authorization-bypass-via-saved-reply

No related operational record is retained in the current change model.