CVE-2026-114392 — Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attacker…
Published: 2026-10-21 · CVSS: 6.9 · CVSS 4.0
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.
Source: CVE Program · Revision f6a1ec2617c75ab2904c463b0d44504dff84e042