CVE-2026-114396: Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

Q: Who can exploit this issue?

An attacker needs an authenticated Trudesk account with access to the ticket search API. The issue is reachable over the network through GET /api/v1/tickets/search.

Q: What impact can exploitation have?

An attacker can inject server-side JavaScript into a MongoDB $where clause. This can be used to loop the mongod process for denial of service or disclose complete ticket documents, including internal notes.

Q: Which versions are known to be affected?

Trudesk through version 1.2.11 is affected.

Published Oct 21, 2026

Updated

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.

Affected Software

1 affected component

Trudesk Trudesk<=1.2.11

Event History

Oct 21, 2026

CVE Published

via MITRE·12:39 PM

Data Sourced

via MITRE·12:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated Trudesk account with access to the ticket search API. The issue is reachable over the network through GET /api/v1/tickets/search.

What impact can exploitation have?

An attacker can inject server-side JavaScript into a MongoDB $where clause. This can be used to loop the mongod process for denial of service or disclose complete ticket documents, including internal notes.

Which versions are known to be affected?