{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-12952",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-12952",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-12-10T07:11:31.026Z",
    "updatedAt": "2025-12-10T15:05:59.003Z",
    "importedAt": "2026-10-24T01:57:24.991Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Privilege Escalation in Dialogflow CX via Webhook Admin Role",
      "summary": "A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX.\n\nDialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. \nThis allows the attacker to escalate their privileges from agent-level to project-level, granting them unauthorized access to manage resources in services associated with the project, leading to unexpected costs and resource depletion for the producer project.\n\nA fix was applied on the server side to protect from this vulnerability in February 2025. No customer action is required.",
      "affected": [
        {
          "vendor": "Google Cloud",
          "product": "Dialogflow CX",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "date",
              "lessThan": "2025-02"
            }
          ]
        }
      ]
    }
  }
}