CVE-2026-114401
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows…
- Risk score
- 44/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' respo…
- Affected
- Trudesk Project Trudesk
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Trudesk Project Trudesk: Amber, patch this week. Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename c…
The flaws
- CVE-2026-114401: Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows… (CVSS 5.3 · EPSS 0%)
- CVE-2026-114400: Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated… (CVSS 7.5 · EPSS 1%)
- CVE-2026-114397: Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled… (CVSS 7.4 · EPSS 1%)
- CVE-2026-114396: Denial of service (CVSS 7.1 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Trudesk Project Trudesk
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-943 (CWE-943). 25 other warnings in 30 days
- Same product: Earlier Trudesk Project Trudesk warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 5.3 medium
- Public exploit or proof of concept referenced
References
- https://github.com/polonel/trudesk
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/common.js#L45-L65
- https://github.com/polonel/trudesk/blob/v1.2.11/src/models/user.js#L310-L319
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-username-enumeration-via-regex-injection-in-api-v1-login
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
Original description
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
Last activity 21 Oct 2026. Patch Forecast updates every hour.