PT-2025-50307 · Google Cloud · Dialogflow Cx

Asterfiester · Published 2025-12-10 · Updated 2025-12-10 · CVE-2025-12952

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

Name of the Vulnerable Software and Affected Versions Google Cloud Dialogflow CX (affected versions not specified)

Description A privilege escalation issue exists in Google Cloud's Dialogflow CX. Developers with Webhook editor permission can configure Webhooks using Dialogflow service agent access token authentication. This allows an attacker to escalate privileges from agent-level to project-level, gaining unauthorized access to manage project resources, potentially leading to unexpected costs and resource depletion. The issue involves the use of Dialogflow service agent access tokens for Webhook authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-12952

Affected Products

Dialogflow Cx

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12952 · Security Note
• https://t.me/CVEtracker/39344 · Telegram Post
• https://docs.cloud.google.com/dialogflow/docs/release-notes#June_12_2025 · Note
• https://twitter.com/VulmonFeeds/status/1998702531564687484 · Twitter Post
• https://twitter.com/CVEnew/status/1998732746513125433 · Twitter Post
• https://t.me/cveNotify/145301 · Telegram Post