Live › vulnerability › CVE-2026-114392
Go to dashboardTrudesk through 1.2.11 skips group membership checks on its single-ticket API endpoint. Any logged-in user can enumerate sequential ticket uids and read subjects, issues, comments, owners and assignees of tickets they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or internal Trudesk instances running version 1.2.11 or earlier, where any authenticated user can reach the ticket API. Instances where all users share the same groups or access is limited to trusted staff face less exposure. Unauthenticated visitors cannot exploit this.
No product ranges from the sources yet.
npm ls trudesk or the version shown in the admin panel; versions through 1.2.11 are affected.GET /api/v1/tickets/:uid responds with tickets for users who are not members of the ticket's group.1.2.11; the sources do not name the fixed version, so check the project's releases page.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-114392")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.