4.3Mittel
CVE-2026-114393Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
Beschreibung
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
Schwachstellentyp (CWE):
CWE-639
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| polonel | trudesk | ≤ 1.2.11 | |
| trudesk project | trudesk | ≤ 1.2.11 |
Referenzen und Patches
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211 third-party-advisoryExploitThird Party Advisory
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/tickets.js#L767-L883 technical-descriptionPatch
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v2/tickets.js#L167-L197 technical-descriptionPatch
- https://github.com/polonel/trudesk productProduct
- VulnCheck Advisory: Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints third-party-advisoryThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:trudesk_project:trudesk:*:*:*:*:*:*:*:*≤ 1.2.11