CVE-2026-114393 — Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and P…
Published: 2026-10-21 · CVSS: 5.3 · CVSS 4.0
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7