Trudesk CVE-2026-114396

Requires an authenticated Trudesk account (any low-privilege user suffices, per PR:L) with access to the GET /api/v1/tickets/search API endpoint. The attacker supplies a search parameter that terminates the regular expression and injects JavaScript into the MongoDB $where clause used by the ticket search query; this works against a default Trudesk deployment backed by MongoDB with no special configuration toggle needed. The primary limiting factor is authentication - exploitation is not possible pre-auth - so realistic risk is from malicious or compromised low-privilege users rather than anonymous internet attackers. Impact scales with MongoDB server-side JavaScript being enabled (the default assumption for the $where evaluation path).

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H, score 7.1) indicates network-reachable, low-complexity exploitation that requires low-level authentication (PR:L) - an existing Trudesk user account - with the dominant impact being availability (VA:H, the mongod denial-of-service loop) and a secondary confidentiality leak (VC:L, exposure of ticket documents and internal notes). Exploitation status: no public exploit identified at time of analysis - the input provides no KEV listing and no explicit POC flag, though a third-party HackMD write-up and a VulnCheck advisory describe the technique, so weaponization is low-effort even if no packaged exploit is confirmed. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified, and no SSVC decision data was provided. The authentication requirement (PR:L) and the niche footprint of Trudesk meaningfully cap real-world risk; this is a credible insider/low-privilege-abuse and limited-data-exposure problem rather than an internet-wide mass-exploitation threat. Note the confidentiality impact is low per the vector despite the description citing leakage of 'full ticket documents including internal notes' - defenders handling sensitive helpdesk data may reasonably weigh that exposure higher than VC:L implies.

A low-privileged authenticated Trudesk user (or an attacker who has obtained any valid account) sends a crafted GET request to /api/v1/tickets/search where the search parameter closes the regular expression and injects JavaScript into the MongoDB $where clause. Depending on the payload, this either forces mongod into an expensive/infinite evaluation loop causing denial of service, or returns ticket documents beyond the user's intended scope, leaking internal notes. No public packaged exploit is confirmed, but a HackMD write-up documents the technique.