CVE-2026-111345: Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Trudesk user can exploit it. The attacker only needs the ID of a conversation they are not authorized to participate in.
What information can be exposed?
A successful request can return the full message history for the targeted private conversation, along with participants' usernames, full names, and email addresses.
Is user interaction or elevated privilege required?
No user interaction or elevated privilege is required. A low-privileged authenticated account can send a GET request to the affected conversation endpoint.