---
id: "CVE-2026-114393"
kind: "vulnerability"
aliases: ["CVE-2026-114393"]
title: "Trudesk: any logged-in user can edit tickets outside their groups"
severity: "medium"
cvss: 5.3
epss: 0.00223
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["helpdesk", "package", "self-hosted", "trudesk"]
not_affected_if: ["no-untrusted-accounts", "single-group-use"]
published_at: "2026-10-21T13:18:29+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:20:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114393", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114393", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Trudesk: any logged-in user can edit tickets outside their groups

Trudesk through 1.2.11 lets any authenticated user change tickets that belong to other groups through its ticket update API. An attacker can alter status, subject, group, priority or assignee, or close many tickets at once.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Trudesk version (`package.json` in the Trudesk install directory); versions through `1.2.11` are affected
- Confirm whether the ticket API is reachable by ordinary user accounts on your instance

## Fix

- Upgrade Trudesk to a release newer than `1.2.11` once a fixed version is published (unknown in the sources)
- Until patched, restrict who has accounts on the instance and review recent ticket changes for unexpected edits

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114393
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114393

## From the sources

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_