CVE-2026-111345

Received Received - Intake

Authorization Bypass in Trudesk Exposes Private Conversations

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111345

Affected Vendors & Products

Vendor	Product	Version / Range
polonel	trudesk	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Trudesk through version 1.2.11 has an authorization bypass flaw. Any authenticated user can read private conversations by providing another conversation's ID. The vulnerability exists in the GET /api/v1/messages/conversation/:id endpoint, which does not verify if the user is a participant in the requested conversation.

Detection Guidance

Check for unauthorized access to private conversations by monitoring GET requests to /api/v1/messages/conversation/:id. Look for requests from authenticated users accessing conversation IDs they are not part of.

Impact Analysis

Attackers with valid credentials can access private message histories, including usernames, full names, and email addresses of all participants. This could lead to data breaches, unauthorized information disclosure, and potential follow-on attacks like phishing or social engineering.

Compliance Impact

This vulnerability likely violates privacy requirements in GDPR and HIPAA by exposing personal data without proper authorization. Organizations using Trudesk may face compliance violations, legal penalties, and reputational damage due to unauthorized data access.

Mitigation Strategies

Update Trudesk to the latest version beyond 1.2.11. Implement strict access controls to ensure users can only access conversations they are part of. Review server logs for suspicious GET requests to /api/v1/messages/conversation/:id.

Hi! I’m here to help you understand CVE-2026-111345. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70