Live › vulnerability › CVE-2026-114393
Go to dashboardTrudesk through 1.2.11 lets any authenticated user change tickets that belong to other groups through its ticket update API. An attacker can alter status, subject, group, priority or assignee, or close many tickets at once.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Trudesk instance running version 1.2.11 or earlier where users with ordinary accounts can log in. The flaw is in the ticket update endpoints, so any deployment that holds tickets across several groups is exposed; single-group setups have less to lose. Teams that do not run Trudesk can skip it.
No product ranges from the sources yet.
package.json in the Trudesk install directory); versions through 1.2.11 are affected1.2.11 once a fixed version is published (unknown in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
This page as .md · .json · in your agent: get_signal("CVE-2026-114393")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.