CVE-2026-114392

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Trudesk via Ticket Enumeration

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114392

EUVD

EUVD-2026-107239

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Trudesk through version 1.2.11 has an authorization bypass flaw in the GET /api/v1/tickets/:uid endpoint. Authenticated users can read tickets outside their assigned groups by enumerating sequential ticket IDs. The apiTickets.single handler skips group membership checks, exposing ticket subjects, issues, comments, owners, and assignees without proper authorization.

Detection Guidance

To detect this vulnerability, monitor API requests to GET /api/v1/tickets/:uid. Check for sequential or unusual ticket ID enumeration attempts by authenticated users. Inspect logs for repeated access to ticket endpoints outside assigned groups. Use network traffic analysis tools like Wireshark or tcpdump to capture and inspect HTTP GET requests to this endpoint.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive ticket data, including subjects, issues, comments, owners, and assignees. Attackers can enumerate ticket IDs to retrieve confidential information, potentially leading to data breaches or unauthorized access to internal communications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Exposure of personal or confidential information may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade Trudesk to a version beyond 1.2.11 where this vulnerability is patched. If upgrading is not possible, restrict access to the GET /api/v1/tickets/:uid endpoint to authorized groups only. Implement strict input validation to prevent sequential ID enumeration. Review and audit all user permissions to ensure proper group-based access controls are enforced.

Hi! I’m here to help you understand CVE-2026-114392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...