4.3Orta
CVE-2026-114393Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
Açıklama
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
Zayıflık türü (CWE):
CWE-639
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| polonel | trudesk | ≤ 1.2.11 | |
| trudesk project | trudesk | ≤ 1.2.11 |
Kaynaklar ve yamalar
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211 third-party-advisoryExploitThird Party Advisory
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/tickets.js#L767-L883 technical-descriptionPatch
- https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v2/tickets.js#L167-L197 technical-descriptionPatch
- https://github.com/polonel/trudesk productProduct
- VulnCheck Advisory: Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints third-party-advisoryThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:trudesk_project:trudesk:*:*:*:*:*:*:*:*≤ 1.2.11