CVE-2026-114393
CVE-2026-114393 · Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
CVSS 5.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
trudesk
- Versions
- ≥ 0, ≤ 1.2.11: Affected (semver)
No fix published
Original sources
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/tickets.js#L767-L883
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v2/tickets.js#L167-L197
- https://github.com/polonel/trudesk
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-ticket-update-api-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-114393