UVdesk core-framework versions before 1.1.7 contain an improper privilege management flaw in the editAgent endpoint that allows any agent possessing an agent-management privilege to elevate its own role to administrator. By submitting its own account identifier along with a role parameter set to ROLE_ADMIN, an attacker can obtain full administrative control over agents, tickets, and mail configuration within the application.

The vulnerability affects installations of UVdesk community‑skeleton and UVdesk core‑framework that are running a version earlier than 1.1.7. Users of these products should verify whether their deployment uses a susceptible version and plan an upgrade accordingly.

The CVSS score of 8.6 indicates high severity, while the EPSS score is not available, leaving the actual exploitation probability uncertain at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by interacting with the web‑based editAgent endpoint, which is likely reachable remotely for any authenticated agent. Based on the description, it is inferred that the attack vector is remote via the HTTP interface, requiring only agent‑management permissions to be present.