CVE-2026-114395

Analyzed Analyzed - Analysis Complete

Authorization Bypass in Trudesk via apiMessages.send

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114395

EUVD

EUVD-2026-107242

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Trudesk through version 1.2.11 has an authorization bypass flaw in the apiMessages.send function. Authenticated users can exploit this by sending POST requests to /api/v1/messages/send with arbitrary owner and cId values to impersonate other users and inject spoofed messages into conversations they don't belong to. This is due to an incomplete fix for CVE-2022-1931.

Detection Guidance

Check Trudesk API logs for POST requests to /api/v1/messages/send with manipulated owner or cId parameters. Inspect message metadata for inconsistencies between sender and conversation participants. Monitor for unauthorized message creation in conversations where the sender is not a member.

Impact Analysis

This vulnerability allows attackers to impersonate other users by sending messages on their behalf. It could lead to misinformation, unauthorized access to sensitive conversations, or manipulation of ticketing systems. Since it requires authentication but no special privileges, any authenticated user could exploit it.

Compliance Impact

This vulnerability allows authenticated users to impersonate others by sending spoofed messages, which could lead to unauthorized data access or manipulation. For GDPR, this may violate principles of data integrity and confidentiality. For HIPAA, it could enable unauthorized disclosure of protected health information.

Mitigation Strategies

Upgrade Trudesk to a version beyond 1.2.11 where this issue is resolved. Review and restrict API access to trusted users only. Implement input validation for owner and cId parameters in the /api/v1/messages/send endpoint. Monitor for suspicious message activity post-upgrade.

Hi! I’m here to help you understand CVE-2026-114395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...