CVE-2026-114401: Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a. and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can submit crafted username values to POST /api/v1/login over the network.
What information can be disclosed?
The issue allows enumeration of valid usernames. Attackers distinguish valid from invalid accounts by comparing responses: valid usernames produce an "Invalid Password" response, while non-existent usernames produce "Invalid User."
Which deployments should be considered affected?
Trudesk versions through 1.2.11 are affected. The vulnerable behavior is exposed through the login API endpoint, so deployments where POST /api/v1/login is reachable by an attacker are exposed to username enumeration.
How can I check whether my instance is vulnerable?
Submit a regex-style username pattern, such as a prefix pattern or alternation, to POST /api/v1/login and compare the response with that for a clearly invalid username. Different "Invalid User" and "Invalid Password" responses indicate that account existence can be inferred.