Authorization Bypass in Trudesk by Polonel
CVE-2026-114392

5.3MEDIUM

Key Information:

Vendor

Polonel

Status
Trudesk
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114392?

Trudesk versions up to 1.2.11 are susceptible to an authorization bypass flaw that enables authenticated users to access tickets beyond their assigned groups. This vulnerability arises from the API endpoint /api/v1/tickets/:uid, where crucial group membership checks are omitted. Attackers can exploit this weakness by systematically iterating through sequential ticket UIDs, thereby obtaining detailed information such as ticket subjects, issues, comments, ownership, and assignment details.

Affected Version(s)

trudesk 0 <= 1.2.11

References

https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
third-party-advisory
https://github.com/polonel/trudesk/blob/v1.2.11/src/contr...
technical-description
https://github.com/polonel/trudesk
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.