{"id":"CVE-2026-114397","kind":"vulnerability","aliases":["CVE-2026-114397"],"related":[],"title":"Trudesk: debug routes let unauthenticated users wipe data and log in","description":"Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.","summary":"Trudesk through 1.2.11 exposes debug routes whenever NODE_ENV is unset, with no authentication required. An attacker can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts that use the password 'password'.","severity":"high","cvss":8.3,"epss":0.0042,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helpdesk","node.js","package","self-hosted","trudesk"],"not_affected_if":["managed-hosting","node_env=production"],"how_to_check":"- Check whether `NODE_ENV` is set in the Trudesk process environment; if it is unset, the debug routes are enabled.\n- Request `/debug/populatedb` on the Trudesk host; a response instead of a 404 means the routes are reachable.\n- Check the installed Trudesk version with `npm ls trudesk` or the package.json in the install directory, versions 1.2.11 and earlier are affected.","fix":"- Upgrade Trudesk to a version later than `1.2.11`; the sources do not name the fixed release, so check the project's releases.\n- Set `NODE_ENV=production` for the Trudesk process to disable the debug routes as a workaround.\n- Change the password of any seeded account, and remove seeded accounts that use `password`.\n- Block `/debug/` paths at the reverse proxy until the upgrade is done.","status":"open","published_at":"2026-10-21T13:18:30+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:02:11+00:00","updated_at":"2026-10-25T03:02:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:02:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trudesk to a version later than `1.2.11`; the sources do not name the fixed release, so check the project's releases.\n- Set `NODE_ENV=production` for the Trudesk process to disable the debug routes as a workaround.\n- Change the password of any seeded account, and remove seeded accounts that use `password`.\n- Block `/debug/` paths at the reverse proxy until the upgrade is done.","reach":"internet","title":"Trudesk: debug routes let unauthenticated users wipe data and log in","impact":"high","summary":"Trudesk through 1.2.11 exposes debug routes whenever NODE_ENV is unset, with no authentication required. An attacker can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts that use the password 'password'.","category":"package","nicknames":[],"who_cares":["trudesk","node.js","self-hosted","helpdesk"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker wipes ticket data and logs in with seeded default accounts","analyst_note":"Sources do not name the fixed Trudesk version or confirm whether seeded accounts exist by default; check the Trudesk GitHub advisory and release notes.","how_to_check":"- Check whether `NODE_ENV` is set in the Trudesk process environment; if it is unset, the debug routes are enabled.\n- Request `/debug/populatedb` on the Trudesk host; a response instead of a 404 means the routes are reachable.\n- Check the installed Trudesk version with `npm ls trudesk` or the package.json in the install directory, versions 1.2.11 and earlier are affected.","needs_analyst":true,"not_affected_if":["NODE_ENV=production","managed-hosting"],"who_is_affected":"Any Trudesk install through 1.2.11 where the NODE_ENV environment variable is not set is exposed, since the debug routes are enabled by default in that state. Installs that were populated with the seed data and still use the default accounts are also at risk of takeover. Instances that set NODE_ENV=production and are not reachable from the internet are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":3378,"output_tokens":773,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114397':13A,16A '-2026':12A,15A '/debug/populatedb':43B,88C '1.2.11':26B,64C 'account':56B,101C 'attack':40B,81C,85C 'authent':37B,68C 'call':42B,87C 'contain':65C 'cve':11A,14A 'data':8A 'debug':2A,28B,71C 'delet':45B,90C 'enabl':73C 'env':32B,76C 'expos':27B 'group':47B,92C 'helpdesk':17B 'host':22B 'invok':82C 'let':4A,79C 'log':10A,52B,97C 'miss':67C 'node':31B,75C 'node.js':18B 'packag':19B 'password':60B,61B,104C,105C 'remot':84C 'requir':38B 'rout':3A,29B,72C 'seed':55B,100C 'self':21B 'self-host':20B 'tag':48B,93C 'ticket':50B,95C 'trudesk':1A,23B,24B,62C 'unauthent':5A,80C 'unset':34B,78C 'use':58B,102C 'user':6A 'vulner':69C 'whenev':30B,74C 'wipe':7A","nicknames":[],"mitigations":[],"who_affected":"Any Trudesk install through 1.2.11 where the NODE_ENV environment variable is not set is exposed, since the debug routes are enabled by default in that state. Installs that were populated with the seed data and still use the default accounts are also at risk of takeover. Instances that set NODE_ENV=production and are not reachable from the internet are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114397","severity":null,"published_at":"2026-10-21T13:18:30+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114397","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114397","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}