CVE-2026-114392
CVE-2026-114392 · Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.
CVSS 6.9 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
trudesk
- Versions
- ≥ 0, ≤ 1.2.11: Affected (semver)
No fix published
Original sources
- https://zineausa.com/blog/2026/10/trudesk-1-2-11-unauthorized-ticket-access-idor/
- https://github.com/polonel/trudesk/issues/754
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-get-api-v1-tickets-uid
- https://nvd.nist.gov/vuln/detail/CVE-2026-114392