{"id":"CVE-2026-114396","kind":"vulnerability","aliases":["CVE-2026-114396"],"related":[],"title":"Trudesk: search parameter injects code into MongoDB queries","description":"Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.","summary":"Trudesk through 1.2.11 lets a logged-in user inject JavaScript into a MongoDB $where clause through the search parameter of the ticket search API. An attacker can use this to hang the database for denial of service or read full ticket documents, including internal notes.","severity":"high","cvss":7.1,"epss":0.00477,"exploited":false,"exploited_at":null,"products":[{"name":"trudesk","fixed":[],"affected":"<= 1.2.11","ecosystem":"github"}],"ecosystems":[],"tags":["auth-required","helpdesk","mongodb","node.js","package","self-hosted","trudesk"],"not_affected_if":["auth-required","managed-hosting","search-endpoint-blocked"],"how_to_check":"- Check the Trudesk version in package.json or the Settings page: 1.2.11 or earlier is affected.\n- Check whether GET /api/v1/tickets/search is reachable by any logged-in user (default 'user' role has tickets:view). Vulnerable code is src/models/ticket.js lines 1184-1215 in v1.2.11.\n- Look in the access logs for search values containing a closing regex delimiter, quotes, or JavaScript.","fix":"No patched version published as of 2026-10-25. Latest release is 1.2.11, which is affected. Restrict access to GET /api/v1/tickets/search (for example block it at a reverse proxy) and limit accounts until the vendor ships a fix. Check github.com/polonel/trudesk for a release newer than 1.2.11.","status":"open","published_at":"2026-10-21T13:18:30+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:52+00:00","updated_at":"2026-10-25T04:02:52+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-25T03:31:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Trudesk: search parameter injects code into MongoDB queries","impact":"medium","summary":"Trudesk through 1.2.11 lets a logged-in user inject JavaScript into a MongoDB $where clause through the search parameter of the ticket search API. An attacker can use this to hang the database for denial of service or read full ticket documents, including internal notes.","category":"package","nicknames":[],"who_cares":["trudesk","mongodb","self-hosted","node.js"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads internal ticket notes or stalls the MongoDB server","analyst_note":"Find the fixed Trudesk version and vendor advisory from the NVD entry; the sources do not give a patch.","how_to_check":"- Check the installed Trudesk version in `package.json` and confirm whether it is `1.2.11` or earlier\n- Confirm whether the instance exposes `GET /api/v1/tickets/search` to users who hold a login","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Self-hosted Trudesk instances at version 1.2.11 or earlier where users have accounts. The attacker must be authenticated, so instances that restrict or do not expose ticket search to outside users have less exposure. The sources do not name a patched version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000596,"input_tokens":3372,"output_tokens":517,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Trudesk version and vendor advisory from the NVD entry; the sources do not give a patch.","search":"'-114396':11A,14A '-2026':10A,13A '/api/v1/tickets/search':108C '1.2.11':29B,75C 'allow':85C 'api':51B 'attack':53B,100C 'auth':17B 'auth-requir':16B 'authent':86C 'claus':42B,95C 'close':102C 'code':5A,90C 'contain':76C 'cve':9A,12A 'databas':60B 'denial':62B,113C 'document':69B,120C 'express':105C 'full':67B,118C 'get':107C 'hang':58B 'helpdesk':19B 'host':25B 'includ':70B,121C 'inject':4A,36B,82C,89C 'intern':71B,122C 'javascript':37B,81C 'leak':117C 'let':30B 'log':33B 'logged-in':32B 'loop':110C 'mongod':111C 'mongodb':7A,20B,40B,93C 'node.js':21B 'note':72B,123C 'packag':22B 'paramet':3A,46B,99C 'queri':8A 'read':66B 'regular':104C 'requir':18B 'search':2A,45B,50B,98C 'self':24B 'self-host':23B 'server':79C 'server-sid':78C 'servic':64B,115C 'side':80C 'ticket':49B,68B,119C 'trudesk':1A,15A,26B,27B,73C 'use':55B 'user':35B,87C 'via':96C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Trudesk instances at version 1.2.11 or earlier where users have accounts. The attacker must be authenticated, so instances that restrict or do not expose ticket search to outside users have less exposure. The sources do not name a patched version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114396","severity":null,"published_at":"2026-10-21T13:18:30+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114396","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114396","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114396:808","url":null,"severity":null,"published_at":"2026-10-25T04:02:52+00:00","modified_at":"2026-10-25T04:02:52+00:00","first_seen_at":"2026-10-25T04:02:52+00:00","fetched_at":"2026-10-25T04:02:52+00:00","note":"No vendor advisory or fixed release found: polonel/trudesk releases list v1.2.11 as latest, finder report (HackMD, Viettel Post leediay153, reported to vendor 2026-09-20) and VulnCheck advisory say <=1.2.11. Related issue #750 was closed as stale with no fix. Nothing marked verified; the HackMD N-2 section was truncated so the exact payload was not read."}],"documents":[{"id":3377,"url":"https://www.vulncheck.com/advisories/trudesk-through-1.2.11-mongodb-where-injection-via-tickets-search-api","title":"VulnCheck: Trudesk through 1.2.11 MongoDB $where Injection via tickets search API","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3378,"url":"https://hackmd.io/@leediay/multiple-vuln-trudesk-1211","title":"Trudesk 1.2.11 Security Report (leediay153), finding N-2","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3379,"url":"https://github.com/polonel/trudesk/releases","title":"polonel/trudesk releases (latest listed v1.2.11)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}