CVE-2026-114401 — Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /a…
Published: 2026-10-21 · CVSS: 6.9 · CVSS 4.0
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7