Live › vulnerability › CVE-2026-114394
Go to dashboardTrudesk through 1.2.11 accepts a user-supplied owner ID when posting comments, internal notes, and tickets. An authenticated user can therefore publish content that appears to come from another user, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Trudesk and let end users or customers hold accounts that can post comments, internal notes or create tickets. Instances where only trusted staff have logins are less exposed, though forged admin attribution still matters internally. unknown whether a patched release exists in the sources.
No product ranges from the sources yet.
1.2.11 are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.
This page as .md · .json · in your agent: get_signal("CVE-2026-114394")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.