CVE-2026-114400: Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
Affected Software
Event History
Frequently Asked Questions
What must an attacker know to retrieve an attachment?
The attacker must know or successfully guess both the ticket ObjectId and the attachment filename. No authentication is required once those values are available.
Are deployments exposed by default?
The described exposure results from express.static serving the public/ directory before the authentication-protected /uploads route. The provided information does not identify any configuration change needed for this behavior.
What data is at risk?
Private ticket attachments stored under /uploads may be downloaded by unauthenticated attackers. The issue affects confidentiality; no integrity or availability impact is described.
How can I assess whether attachments may have been exposed?
Review unauthenticated requests to /uploads for paths containing ticket ObjectIds and attachment filenames, and determine whether those requests returned attachment content. The provided information does not specify available logging fields or indicators beyond the requested paths.