CVE-2026-114393

Analyzed Analyzed - Analysis Complete

Authorization Bypass in Trudesk Lets Users Modify Tickets

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114393

EUVD

EUVD-2026-107240

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Trudesk versions up to 1.2.11 have an authorization bypass flaw. Authenticated users can modify tickets outside their assigned groups by exploiting PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch endpoints. The system only checks for the default tickets:update role without enforcing group-based access controls, allowing unauthorized changes to ticket properties like status, subject, group, priority, or assignee.

Detection Guidance

Check API logs for unauthorized PUT requests to /api/v1/tickets/:id or /api/v2/tickets/batch endpoints. Look for requests modifying ticket properties like status, group, or assignee by non-admin users. Verify if users outside assigned groups can update tickets.

Impact Analysis

An attacker with valid credentials could alter tickets not assigned to their group, potentially changing priorities, reassigning tickets, or closing them without authorization. This could disrupt workflows, lead to data corruption, or allow unauthorized access to sensitive ticket information.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized modifications to sensitive data. GDPR may be impacted if personal data in tickets is altered without consent, while HIPAA could be breached if protected health information is improperly accessed or changed.

Mitigation Strategies

Upgrade Trudesk to a version beyond 1.2.11 where this issue is fixed. If upgrading is not possible, restrict access to PUT /api/v1/tickets/:id and /api/v2/tickets/batch endpoints via network rules or WAF. Implement strict role-based access controls to enforce group-based ticket modifications.

Hi! I’m here to help you understand CVE-2026-114393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...