Privilege Escalation Vulnerability in Google Cloud's Dialogflow CX

CVE-2025-12952

What is CVE-2025-12952?

A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX, where developers with Webhook editor permissions can misconfigure Webhooks using Dialogflow service agent access tokens. This misconfiguration allows unauthorized elevation of privileges from agent-level to project-level, enabling attackers to gain access to manage resources linked to the project. Such access could lead to unexpected operational costs and depletion of resources within the affected project. A server-side fix was deployed in February 2025, eliminating this vulnerability without requiring any customer action.

References