Authorization Bypass in Trudesk Allowing Message Spoofing by Authenticated Users
CVE-2026-114395

5.3MEDIUM

Key Information:

Vendor

Polonel

Status
Trudesk
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114395?

Trudesk versions up to 1.2.11 are impacted by an authorization bypass vulnerability in the apiMessages.send function. This flaw arises from an incomplete fix for a previous vulnerability (CVE-2022-1931) and allows authenticated users to post messages as other users. By manipulating the owner and cId parameters, attackers can inject malicious messages into conversations, thereby compromising chat integrity and potentially misleading other users.

Affected Version(s)

trudesk 0 <= 1.2.11

References

https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
third-party-advisory
https://github.com/polonel/trudesk/blob/v1.2.11/src/contr...
technical-description
https://github.com/polonel/trudesk
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.