{"id":"CVE-2026-114392","kind":"vulnerability","aliases":["CVE-2026-114392"],"related":[],"title":"Trudesk: authenticated users can read tickets outside their groups","description":"Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.","summary":"Trudesk through 1.2.11 skips group membership checks on its single-ticket API endpoint. Any logged-in user can enumerate sequential ticket uids and read subjects, issues, comments, owners and assignees of tickets they should not see.","severity":"medium","cvss":6.9,"epss":0.00224,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helpdesk","node.js","package","self-hosted","trudesk"],"not_affected_if":["auth-required","single-group-deployment"],"how_to_check":"- Check the installed Trudesk version, for example with `npm ls trudesk` or the version shown in the admin panel; versions through `1.2.11` are affected.\n- Review whether `GET /api/v1/tickets/:uid` responds with tickets for users who are not members of the ticket's group.","fix":"- Upgrade Trudesk to a release later than `1.2.11`; the sources do not name the fixed version, so check the project's releases page.\n- Until patched, restrict access to the Trudesk instance to trusted users.","status":"open","published_at":"2026-10-21T13:18:29+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:39:03+00:00","updated_at":"2026-10-25T03:39:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:39:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trudesk to a release later than `1.2.11`; the sources do not name the fixed version, so check the project's releases page.\n- Until patched, restrict access to the Trudesk instance to trusted users.","reach":"internet","title":"Trudesk: authenticated users can read tickets outside their groups","impact":"medium","summary":"Trudesk through 1.2.11 skips group membership checks on its single-ticket API endpoint. Any logged-in user can enumerate sequential ticket uids and read subjects, issues, comments, owners and assignees of tickets they should not see.","category":"package","nicknames":[],"who_cares":["trudesk","self-hosted","helpdesk","node.js"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated user reads other groups' ticket contents, comments and assignees","analyst_note":"","how_to_check":"- Check the installed Trudesk version, for example with `npm ls trudesk` or the version shown in the admin panel; versions through `1.2.11` are affected.\n- Review whether `GET /api/v1/tickets/:uid` responds with tickets for users who are not members of the ticket's group.","needs_analyst":false,"not_affected_if":["auth-required","single-group-deployment"],"who_is_affected":"Self-hosted or internal Trudesk instances running version 1.2.11 or earlier, where any authenticated user can reach the ticket API. Instances where all users share the same groups or access is limited to trusted staff face less exposure. Unauthenticated visitors cannot exploit this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3379,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114392':12A,15A '-2026':11A,14A '/api/v1/tickets':81C '1.2.11':25B,63C 'allow':70C 'api':35B 'apitickets.single':102C 'assigne':54B,99C 'attack':83C 'authent':2A,71C 'author':66C 'bypass':67C 'check':29B,107C 'comment':51B,96C 'contain':64C 'cve':10A,13A 'endpoint':36B 'enumer':43B,85C 'everi':91C 'get':80C 'group':9A,27B,78C,105C 'handler':103C 'helpdesk':16B 'host':21B 'issu':50B,95C 'log':39B 'logged-in':38B 'membership':28B,106C 'node.js':17B 'outsid':7A,76C 'owner':52B,97C 'packag':18B 'read':5A,48B,74C,90C 'see':60B 'self':20B 'self-host':19B 'sequenti':44B,86C 'singl':33B 'single-ticket':32B 'skip':26B,104C 'subject':49B,94C 'ticket':6A,34B,45B,56B,75C,87C,92C 'trudesk':1A,22B,23B,61C 'uid':46B,82C,88C 'user':3A,41B,72C 'via':79C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or internal Trudesk instances running version 1.2.11 or earlier, where any authenticated user can reach the ticket API. Instances where all users share the same groups or access is limited to trusted staff face less exposure. Unauthenticated visitors cannot exploit this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114392","severity":null,"published_at":"2026-10-21T13:18:29+00:00","modified_at":"2026-10-23T19:17:43+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114392","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114392","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}