MEDIUM 5.3 NVD
CVE-2026-114394
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying use
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.
References
- https://github.com/polonel/trudesk
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/tickets.js#L954-L10
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-ticke
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.