CVE-2026-114394

Analyzed Analyzed - Analysis Complete

Trudesk Authorization Bypass via User-Controlled Owner IDs

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114394

EUVD

EUVD-2026-107241

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Trudesk through version 1.2.11 has an authorization bypass flaw where authenticated users can manipulate owner IDs in API requests to post content under other users' names, including administrators. This allows forgery of comments, internal notes, and tickets by setting user-controlled owner fields in postComment, postInternalNote, and ticket creation endpoints.

Detection Guidance

To detect this vulnerability, monitor API requests for ticket creation, comments, or internal notes where the ownerId or owner field is modified by non-admin users. Check logs for requests containing user-controlled owner IDs in POST parameters for /api/v1/tickets, /api/v1/tickets/:id/comments, or /api/v1/tickets/:id/internal-notes endpoints.

Impact Analysis

This vulnerability enables attackers to impersonate administrators or other users, potentially spreading misinformation, altering ticket statuses, or manipulating internal communications. It could lead to unauthorized access to sensitive data, system compromise, or reputational damage if exploited in a production environment.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification, undermining audit trails, and compromising user accountability. GDPR requires data integrity and access controls, while HIPAA mandates strict access restrictions for protected health information. Exploitation may lead to non-compliance penalties.

Mitigation Strategies

Immediately update Trudesk to the latest version beyond 1.2.11. Implement strict input validation to reject requests with modified ownerId or owner fields unless the requester is an administrator. Review and restrict API access permissions to prevent unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-114394. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...