Vulnerabilities

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via…

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

4.3

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-114393 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated…

   CVSS 4.3 CVE-2026-114402
2. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by…

   CVSS 5.3 CVE-2026-114401
3. 15
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments…

   CVSS 5.9 CVE-2026-114400 Cisco
4. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal…

   CVSS 6.5 CVE-2026-114399
5. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public…

   CVSS 5.4 CVE-2026-114398
6. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other…

   CVSS 4.3 CVE-2026-114395
7. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by…

   CVSS 4.3 CVE-2026-114394
8. 3
   CVE NVD 16d ago

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET…

   CVSS 4.3 CVE-2026-114392