CVE-2026-114392
Trudesk Project Trudesk: authorisation bypass
- Risk score
- 44/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single hand…
- Affected
- Trudesk Project Trudesk
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Trudesk Project Trudesk: Amber, patch this week. Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename c…
The flaws
- CVE-2026-114392: Authorisation bypass (CVSS 5.3 · EPSS 0%)
- CVE-2026-114400: Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated… (CVSS 7.5 · EPSS 1%)
- CVE-2026-114397: Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled… (CVSS 7.4 · EPSS 1%)
- CVE-2026-114396: Denial of service (CVSS 7.1 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Trudesk Project Trudesk
Where it stands
- Public proof of concept
Connects to
- Same weakness: Authorisation bypass (CWE-639). 272 other warnings in 30 days
- Same product: Earlier Trudesk Project Trudesk warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 5.3 medium
- Public exploit or proof of concept referenced
References
- https://github.com/polonel/trudesk
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/tickets.js#L721-L740
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-get-api-v1-tickets-uid
- https://github.com/polonel/trudesk/issues/754
- https://zineausa.com/blog/2026/10/trudesk-1-2-11-unauthorized-ticket-access-idor/
Original description
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.
Last activity 21 Oct 2026. Patch Forecast updates every hour.