Authorization Bypass in Trudesk Allows Unauthorized Ticket Modifications
CVE-2026-114393

5.3MEDIUM

Key Information:

Vendor

Polonel

Status
Trudesk
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114393?

Trudesk version 1.2.11 is exposed to an authorization bypass vulnerability that permits any authenticated user to alter tickets beyond their designated user groups through specific API endpoints. This flaw can be exploited via the PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch methods, allowing attackers to manipulate ticket properties such as status, subject, group, priority, or assignee. The issue arises because only the default 'tickets:update' role permission is verified, potentially enabling unauthorized users to perform actions like mass-closing tickets by providing arbitrary ticket Object IDs.

Affected Version(s)

trudesk 0 <= 1.2.11

References

https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
third-party-advisory
https://github.com/polonel/trudesk/blob/v1.2.11/src/contr...
technical-description
https://github.com/polonel/trudesk/blob/v1.2.11/src/contr...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.