Live › vulnerability › CVE-2026-114396
Go to dashboardTrudesk through 1.2.11 lets a logged-in user inject JavaScript into a MongoDB $where clause through the search parameter of the ticket search API. An attacker can use this to hang the database for denial of service or read full ticket documents, including internal notes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Trudesk instances at version 1.2.11 or earlier where users have accounts. The attacker must be authenticated, so instances that restrict or do not expose ticket search to outside users have less exposure. The sources do not name a patched version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| trudesk | github | <= 1.2.11 | – |
1.2.11, which is affected1.2.11Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
This page as .md · .json · in your agent: get_signal("CVE-2026-114396")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.