Authorization Bypass Vulnerability in Trudesk by Polonel

CVE-2026-111345

What is CVE-2026-111345?

Trudesk versions up to 1.2.11 are affected by an authorization bypass vulnerability that enables authenticated users to access private conversations. This flaw allows users to exploit the system by submitting a conversation ID to the API endpoint GET /api/v1/messages/conversation/:id without proper participant verification. As a result, attackers can retrieve sensitive information such as full message history, usernames, full names, and email addresses of participants. It is imperative that users upgrade to the latest version and follow security best practices to mitigate this risk.

References