CVE-2026-114397: Trudesk through 1.2.11 Missing Authentication on Debug Routes
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODEENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Trudesk deployments through version 1.2.11 are exposed when NODE_ENV is unset, because this enables the unauthenticated debug routes. The affected route can be invoked remotely.
What can an unauthenticated attacker do?
An attacker can call /debug/populatedb to delete all groups, tags, and tickets. They can then log in using seeded accounts with the password "password".
How can I determine whether an instance may have been exploited?
Investigate whether /debug/populatedb was requested and whether groups, tags, or tickets were unexpectedly deleted. Also review accounts for seeded accounts that may have been used with the password "password".