Live › vulnerability › CVE-2026-114395
Go to dashboardTrudesk through 1.2.11 has an incomplete fix for CVE-2022-1931 in its message send API. An authenticated user can set arbitrary owner and cId values on POST /api/v1/messages/send and inject spoofed messages into conversations they are not part of.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Trudesk 1.2.11 or earlier with user accounts that are not all trusted. Exposure depends on any authenticated user being able to reach the messages API. Instances on a later version or with no untrusted accounts can skip it.
No product ranges from the sources yet.
grep '"version"' package.json) and see whether it is 1.2.11 or earlier./api/v1/messages/send that carry owner or cId values not matching the logged-in user.1.2.11; unknown whether a fixed version is published.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.
This page as .md · .json · in your agent: get_signal("CVE-2026-114395")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.