CVE-2026-114393: Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Trudesk user with the default tickets:update role grant can exploit it. The affected endpoints do not enforce that the user belongs to the group associated with the ticket being modified.
What access and information does an attacker need?
An attacker needs a valid authenticated account with tickets:update permission and the ObjectId values of target tickets. They can submit arbitrary ticket ObjectIds to the single-ticket or batch ticket update endpoints.
What changes can an attacker make?
An attacker can modify ticket status, subject, group, priority, or assignee for tickets outside their authorized groups. The batch endpoint can be used to mass-close tickets.
Are default role settings affected?
Yes. Exploitation relies on the default tickets:update role grant being checked, without group-level authorization validation.