CVE-2026-114393 Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114393?
CVE-2026-114393 is a medium-severity vulnerability in polonel trudesk, published on 21 Oct 2026.
Official description
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
Weakness: CWE-639
Which versions are affected by CVE-2026-114393?
How do I fix CVE-2026-114393?
No fix has been published for CVE-2026-114393 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114393 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114393 exists.
Sources
Also known as GHSA-hqv6-jg73-3gmv.