CVE-2026-114395
CVE-2026-114395 · Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.
CVSS 5.3 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
trudesk
- Versions
- ≥ 0, ≤ 1.2.11: Affected (semver)
No fix published
Original sources
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/messages.js#L183-L253
- https://github.com/polonel/trudesk
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-api-v1-messages-send
- https://nvd.nist.gov/vuln/detail/CVE-2026-114395