CVE-2026-114397

Analyzed Analyzed - Analysis Complete

Trudesk Debug Routes Authentication Bypass

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114397

EUVD

EUVD-2026-107244

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

This vulnerability affects Trudesk versions up to 1.2.11 due to missing authentication on debug routes when the NODE_ENV environment variable is not set. Unauthenticated attackers can remotely access these routes and invoke the /debug/populatedb endpoint, which deletes all groups, tags, and tickets. Attackers can then log in using seeded accounts with the default password 'password'.

Detection Guidance

Check if NODE_ENV is unset in your Trudesk deployment. Verify if debug routes like /debug/populatedb are accessible without authentication. Use curl to test: curl -v http://<target>/debug/populatedb. If the response indicates deletion of data or allows access, the system is vulnerable.

Impact Analysis

This vulnerability allows unauthenticated attackers to completely wipe your Trudesk database, including all support tickets, groups, and tags. They can then gain administrative access using default credentials, leading to full system compromise and potential data loss.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or access, violating GDPR's integrity and confidentiality requirements and HIPAA's safeguards for protected health information. Organizations using affected Trudesk versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Set NODE_ENV to production in your Trudesk configuration. Disable debug routes in production environments. Update Trudesk to the latest version if available. Restrict network access to Trudesk instances and monitor for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-114397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...