Description

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T14:17:14.720Z",
  "pubdate": "2026-09-21T14:17:14.720Z",
  "executiveSummary": "UVdesk core-framework versions prior to 1.1.7 are affected by an authorization bypass vulnerability within the saved reply endpoint.\nThe vulnerability allows authenticated users assigned the ROLE_AGENT privilege to access and retrieve sensitive content from saved replies that are restricted to specific support groups or teams to which the agent does not belong.\nThis represents a significant breakdown in the Principle of Least Privilege and access control enforcement within the application's multi-tenant or group-based management logic.\nAn attacker with legitimate agent access can exploit this flaw to perform unauthorized data enumeration and information disclosure.\nThe impact includes the exposure of internal workflows, proprietary support procedures, and potentially sensitive data contained within restricted saved reply templates.\nSuccessful exploitation requires the attacker to hold an existing agent account, though no administrative privileges are necessary, making this a high-risk scenario for organizations relying on granular group-based support permissions.",
  "technicalDetails": "The vulnerability exists within the access control logic governing the saved reply retrieval mechanism in the UVdesk core-framework. The application fails to properly validate the authorization context of an authenticated user against the group-level permissions associated with requested saved reply resources.\nWhen an agent interacts with the saved reply endpoint, the system is expected to cross-reference the requester's assigned group or team membership with the accessibility metadata of the requested ID. In vulnerable versions, this validation process is either omitted or improperly implemented, allowing a user to circumvent group-based restrictions.\nThe attack flow begins with an authenticated attacker possessing the ROLE_AGENT privilege. The attacker identifies the API endpoint or application route used to fetch saved reply data. By systematically iterating through integer-based or predictable identifiers (a process known as Insecure Direct Object Reference or IDOR), the attacker can request replies intended for teams outside their authorized scope.\nBecause the server-side controller does not enforce a group-membership check on the requested ID, the application returns the contents of the saved reply object regardless of whether the agent belongs to the team defined by the ACL policy.\nThis enumeration technique allows an attacker to map out the entire inventory of saved replies across all support groups. The technical impact involves unauthorized access to private templates, which may contain sensitive company knowledge, standardized support responses, or internal notes designated only for specific support personnel.\nThe root cause lies in the insufficient application of server-side authorization checks on the data retrieval layer for saved replies. The vulnerability specifically affects the core-framework component before version 1.1.7, and it can be exploited remotely by any authenticated user who has access to the support portal's agent interface.\nThe post-exploitation scenario involves the exfiltration of restricted organizational data, which could facilitate further social engineering or provide insights into how specific teams handle escalations, directly undermining the segmentation security model of the helpdesk platform."
}