CVE-2026-114392: Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Trudesk user can exploit it. The attacker only needs a valid account and network access to the affected API endpoint; no user interaction is required.
What information can an attacker access?
An attacker can read tickets outside their assigned groups, including ticket subjects, issues, comments, owners, and assignees. Sequential ticket UIDs can be enumerated to retrieve every ticket.
Are default deployments affected?
Deployments running Trudesk through 1.2.11 are affected if authenticated users can access GET /api/v1/tickets/:uid. The bypass is caused by the endpoint handler not checking group membership.