Trudesk CVE-2026-114397

Exploitation requires the Trudesk instance (≤1.2.11) to be running with the NODE_ENV environment variable unset - this leaves the /debug/* routes (notably /debug/populatedb) registered and reachable; a production deployment that sets NODE_ENV=production does not expose them, which is the primary limiting factor. When that condition holds, no authentication, no user interaction, and no special privileges are needed (PR:N/UI:N), and the attack works against the network-reachable HTTP interface. The destructive action is irreversible data loss (groups, tags, tickets), and follow-on access depends on the default seeded accounts still using the password 'password'.

Signals point to a credible but conditionally-gated destructive flaw rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, no-interaction reachability, but AT:P (Attack Requirement: Present) encodes a real precondition - the debug routes are only exposed when NODE_ENV is unset. Reported by VulnCheck with a corroborating VulnCheck advisory and an independent HackMD technical write-up, the root cause and exploitation path are well-documented. No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied in the input, so this is: no public exploit identified at time of analysis, and not confirmed actively exploited. Impact is integrity/availability only (VI:H/VA:H, VC:N): /debug/populatedb wipes groups, tags, and tickets and reseeds accounts whose password is 'password', enabling takeover of a reset instance. Note the apparent tension - the vendor vector sets VC:N (no confidentiality impact), yet logging in via the seeded 'password' account would in practice grant application access; the official vector attributes impact to the data-destruction primitive, not the post-reset login, so confidentiality is scored conservatively. Overall: real priority for any Trudesk operator running without NODE_ENV set to production, but the non-default configuration dependency and the product's niche footprint lower aggregate real-world risk versus a true 8.3-across-the-board flaw.

An attacker locates an internet-exposed Trudesk helpdesk (≤1.2.11) started without NODE_ENV configured, so the /debug routes are live. They send an unauthenticated HTTP request to /debug/populatedb, destroying all groups, tags, and tickets and reseeding default accounts, then log in with a seeded account using the password 'password' to control the reset instance. A HackMD technical write-up documents the route and method, though no packaged exploit was indicated in the provided data.