CVE-2026-114400

Analyzed Analyzed - Analysis Complete

Trudesk Missing Authentication Allows Unauthenticated Attachment Download

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114400

EUVD

EUVD-2026-107247

Affected Vendors & Products

Vendor	Product	Version / Range
trudesk_project	trudesk	to 1.2.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

Executive Summary

Trudesk through version 1.2.11 has a missing authentication vulnerability where unauthenticated attackers can download private ticket attachments. This happens because the Express static file server serves the public/ directory before the /uploads mount point, which should require authentication. Attackers who know or guess a ticket's ObjectId and filename can retrieve confidential attachments.

Detection Guidance

Check if Trudesk version 1.2.11 or earlier is installed. Verify if the /uploads endpoint is accessible without authentication by attempting to access known ticket ObjectId and filenames directly via HTTP requests.

Impact Analysis

This vulnerability allows attackers to access sensitive ticket attachments without authentication. If successful, attackers could steal confidential information such as private communications, documents, or other sensitive data stored in ticket attachments. This could lead to data breaches, reputational damage, or further exploitation of the compromised system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive personal or health information. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and loss of trust.

Mitigation Strategies

Upgrade Trudesk to a version beyond 1.2.11 where the vulnerability is patched. If immediate upgrade is not possible, restrict access to the /uploads endpoint via network rules or firewall configurations.

Hi! I’m here to help you understand CVE-2026-114400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...