Trudesk CVE-2026-114392

Requires a valid authenticated Trudesk account of any privilege level (PR:L) - no admin role, group membership in the target ticket's group, user interaction, or non-default configuration is needed, because the apiTickets.single handler omits the group-membership check in default installations through v1.2.11. The attacker only needs network access to the /api/v1/tickets/:uid endpoint and the ability to iterate sequential, predictable ticket uids. Limiting factors that reduce real-world risk: exploitation is gated behind authentication (an attacker must register or compromise at least one account), impact is read-only disclosure of ticket data (no modification, deletion, or code execution), and it affects only Trudesk instances at or below version 1.2.11.

This is a medium-severity authenticated information-disclosure flaw (IDOR / CWE-639), and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 score agree with the description: network-reachable, low attack complexity, no user interaction, but requires an authenticated account (PR:L) and yields only confidentiality impact (VC:L; VI:N/VA:N) with no scope change. No EPSS score was supplied, and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation. The references include a public technical write-up (hackmd) and a pointer to the exact vulnerable source lines, which lowers the research barrier, but no weaponized exploit tool was provided in the input. Net assessment: a genuine but bounded priority - trivial for any logged-in user to abuse and to automate via sequential uid enumeration, yet gated behind authentication and limited to reading ticket data (no write, no code execution, no system compromise). It warrants prompt patching for multi-tenant/self-hosted help-desk deployments but does not rise to drop-everything criticality. Missing data to note explicitly: EPSS probability is absent, and POC/active-exploitation status is not flagged in the input beyond the explanatory write-up.

A low-privileged but authenticated Trudesk user (e.g., a regular agent or an attacker who registered/compromised any single account) issues GET /api/v1/tickets/:uid and iterates through sequential ticket uids. Because the apiTickets.single handler skips group-membership checks, the attacker harvests the subject, issue body, comments, owner, and assignee of every ticket in the system, including those belonging to other groups or tenants. A public technical write-up documenting the exact endpoint and vulnerable code exists, making this straightforward to reproduce and script, though no packaged exploit tool was provided in the input.