{"id":"CVE-2026-114393","kind":"vulnerability","aliases":["CVE-2026-114393"],"related":[],"title":"Trudesk: any logged-in user can edit tickets outside their groups","description":"Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.","summary":"Trudesk through 1.2.11 lets any authenticated user change tickets that belong to other groups through its ticket update API. An attacker can alter status, subject, group, priority or assignee, or close many tickets at once.","severity":"medium","cvss":5.3,"epss":0.00223,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helpdesk","package","self-hosted","trudesk"],"not_affected_if":["no-untrusted-accounts","single-group-use"],"how_to_check":"- Check the installed Trudesk version (`package.json` in the Trudesk install directory); versions through `1.2.11` are affected\n- Confirm whether the ticket API is reachable by ordinary user accounts on your instance","fix":"- Upgrade Trudesk to a release newer than `1.2.11` once a fixed version is published (unknown in the sources)\n- Until patched, restrict who has accounts on the instance and review recent ticket changes for unexpected edits","status":"open","published_at":"2026-10-21T13:18:29+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:20:57+00:00","updated_at":"2026-10-25T04:20:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:20:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trudesk to a release newer than `1.2.11` once a fixed version is published (unknown in the sources)\n- Until patched, restrict who has accounts on the instance and review recent ticket changes for unexpected edits","reach":"internet","title":"Trudesk: any logged-in user can edit tickets outside their groups","impact":"medium","summary":"Trudesk through 1.2.11 lets any authenticated user change tickets that belong to other groups through its ticket update API. An attacker can alter status, subject, group, priority or assignee, or close many tickets at once.","category":"package","nicknames":[],"who_cares":["trudesk","self-hosted","helpdesk"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker alters or mass-closes tickets belonging to other groups","analyst_note":"Find the vendor's fixed version and advisory; the sources give no patched release.","how_to_check":"- Check the installed Trudesk version (`package.json` in the Trudesk install directory); versions through `1.2.11` are affected\n- Confirm whether the ticket API is reachable by ordinary user accounts on your instance","needs_analyst":true,"not_affected_if":["single-group-use","no-untrusted-accounts"],"who_is_affected":"Any Trudesk instance running version 1.2.11 or earlier where users with ordinary accounts can log in. The flaw is in the ticket update endpoints, so any deployment that holds tickets across several groups is exposed; single-group setups have less to lose. Teams that do not run Trudesk can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3402,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114393':15A,18A '-2026':14A,17A '/api/v1/tickets':79C '/api/v2/tickets/batch':83C '1.2.11':27B,60C 'allow':67C 'alter':47B 'api':43B 'arbitrari':87C 'assigne':53B,97C 'attack':45B,84C 'authent':30B,69C 'author':63C 'belong':35B 'bypass':64C 'chang':32B,91C 'check':112C 'close':55B,101C 'contain':61C 'cve':13A,16A 'default':106C 'edit':8A 'grant':110C 'group':12A,38B,50B,76C,94C 'helpdesk':19B 'host':23B 'id':80C 'let':28B 'log':4A 'logged-in':3A 'mani':56B 'mass':100C 'mass-clos':99C 'modifi':72C 'objectid':89C 'outsid':10A,74C 'packag':20B 'prioriti':51B,95C 'put':78C,82C 'role':109C 'self':22B 'self-host':21B 'sinc':103C 'status':48B,92C 'subject':49B,93C 'suppli':86C 'ticket':9A,33B,41B,57B,73C,88C,102C,107C 'trudesk':1A,24B,25B,58C 'updat':42B,108C 'user':6A,31B,70C 'via':77C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Any Trudesk instance running version 1.2.11 or earlier where users with ordinary accounts can log in. The flaw is in the ticket update endpoints, so any deployment that holds tickets across several groups is exposed; single-group setups have less to lose. Teams that do not run Trudesk can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114393","severity":null,"published_at":"2026-10-21T13:18:29+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114393","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114393","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}