CVE-2026-114394: Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a Trudesk user. The vulnerability is reachable through ticket comment, internal-note, and ticket-create requests.
What can an attacker do with a forged owner ID?
The attacker can supply ownerId or owner values to attribute comments, internal notes, or newly created tickets to another user, including an administrator. This can affect any ticket.
Which deployments are affected?
Trudesk through version 1.2.11 is affected. The available information does not identify any configuration prerequisite or mitigation setting.
How can I check for possible exploitation?
Review ticket creation, comment, and internal-note activity for content whose apparent author does not match the authenticated user that submitted the request. Pay particular attention to requests containing user-controlled ownerId or owner fields.