{"id":"CVE-2026-114394","kind":"vulnerability","aliases":["CVE-2026-114394"],"related":[],"title":"Trudesk: authenticated users can forge comments and tickets as other users","description":"Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.","summary":"Trudesk through 1.2.11 accepts a user-supplied owner ID when posting comments, internal notes, and tickets. An authenticated user can therefore publish content that appears to come from another user, including administrators.","severity":"medium","cvss":5.3,"epss":0.00279,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helpdesk","package","self-hosted","trudesk"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Trudesk version against the release list; versions through `1.2.11` are affected.\n- Review whether the postComment, postInternalNote and ticket create endpoints accept an ownerId or owner field from the client.","fix":"- unknown","status":"open","published_at":"2026-10-21T13:18:30+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:20:56+00:00","updated_at":"2026-10-25T04:20:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:56Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Trudesk: authenticated users can forge comments and tickets as other users","impact":"medium","summary":"Trudesk through 1.2.11 accepts a user-supplied owner ID when posting comments, internal notes, and tickets. An authenticated user can therefore publish content that appears to come from another user, including administrators.","category":"package","nicknames":[],"who_cares":["trudesk","self-hosted","helpdesk"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker forges administrator-attributed comments and tickets","analyst_note":"Find the fixed Trudesk release and confirm whether ownerId is accepted server-side in the NVD or project repository references.","how_to_check":"- Check the installed Trudesk version against the release list; versions through `1.2.11` are affected.\n- Review whether the postComment, postInternalNote and ticket create endpoints accept an ownerId or owner field from the client.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that self-host Trudesk and let end users or customers hold accounts that can post comments, internal notes or create tickets. Instances where only trusted staff have logins are less exposed, though forged admin attribution still matters internally. unknown whether a patched release exists in the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3376,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114394':14A,17A '-2026':13A,16A '1.2.11':26B,59C 'accept':27B 'administr':56B,99C 'administrator-author':98C 'allow':66C 'anoth':53B 'appear':49B 'attack':83C 'attribut':72C 'authent':2A,42B,67C 'author':62C,100C 'bypass':63C 'come':51B 'comment':6A,36B,101C 'contain':60C 'content':47B,71C 'control':80C 'creat':94C 'cve':12A,15A 'forg':5A,97C 'helpdesk':18B 'host':22B 'id':33B,82C 'includ':55B 'intern':37B,102C 'note':38B,103C 'owner':32B,81C,88C 'ownerid':86C 'packag':19B 'post':35B,70C 'postcom':90C 'postinternalnot':91C 'publish':46B 'request':95C 'self':21B 'self-host':20B 'set':85C 'suppli':31B,77C 'therefor':45B 'ticket':8A,40B,93C,105C,108C 'trudesk':1A,23B,24B,57C 'user':3A,11A,30B,43B,54B,68C,75C,79C 'user-control':78C 'user-suppli':29B 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Trudesk and let end users or customers hold accounts that can post comments, internal notes or create tickets. Instances where only trusted staff have logins are less exposed, though forged admin attribution still matters internally. unknown whether a patched release exists in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114394","severity":null,"published_at":"2026-10-21T13:18:30+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114394","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114394","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}