Regular Expression Injection Vulnerability in Trudesk by Polonel
CVE-2026-114401

6.9MEDIUM

Key Information:

Vendor

Polonel

Status
Trudesk
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114401?

Trudesk versions up to 1.2.11 are susceptible to a regular expression injection vulnerability that enables unauthenticated attackers to enumerate valid usernames. By manipulating regex patterns sent to the POST /api/v1/login endpoint, attackers could differentiate between 'Invalid User' and 'Invalid Password' responses. This exploitation allows attackers to systematically identify valid accounts, posing severe risks to user privacy and security.

Affected Version(s)

trudesk 0 <= 1.2.11

References

https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
third-party-advisory
https://github.com/polonel/trudesk/blob/v1.2.11/src/model...
technical-description
https://github.com/polonel/trudesk/blob/v1.2.11/src/contr...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.