Trudesk EUVD-2026-107240

Requires a valid authenticated Trudesk account holding only the default tickets:update role grant - no admin or elevated privilege needed. The server checks that single role but fails to verify group/ownership of the target ticket, so supplying arbitrary ticket ObjectIds to PUT /api/v1/tickets/:id or PUT /api/v2/tickets/batch is sufficient. Limiting factors: the attacker must already possess login credentials (PR:L, so a registered user, insider, or compromised account), and impact is confined to ticket-data manipulation and mass-closure (integrity/workflow), not data disclosure or service outage. No special non-default configuration or user interaction is required.

This is a moderate-severity authorization bypass (IDOR, CWE-639) with a vendor-supplied CVSS 4.0 score of 5.3. The vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring a low-privilege authenticated account (PR:L) and no user interaction - meaning any existing Trudesk user can trigger it. Impact is deliberately scoped: only VI:L (low integrity) with VC:N and VA:N, reflecting that the flaw lets an attacker tamper with ticket data (status, subject, group, priority, assignee, or mass-close) but does not expose confidential data or crash the service. No EPSS score, KEV listing, or POC flag was provided in the input, so there is no signal of active or probable exploitation; the vulnerability was reported by VulnCheck with a public technical write-up (hackmd) and source-line references, which raises the practical likelihood that working exploit steps can be reconstructed even though no exploit artifact is explicitly flagged. Overall this is a real data-integrity and workflow-disruption issue for Trudesk operators rather than a critical, widely-targeted threat: the low privilege barrier makes it trivially abusable by any insider or compromised low-level account, but the limited impact scope and niche product footprint keep real-world urgency moderate. Note the conflict to verify: the input Tag labels this 'Authentication Bypass,' but the CVE description and CWE-639 make clear it is an authorization (access-control) bypass against already-authenticated users - not an authentication bypass.

A low-privilege authenticated Trudesk user (e.g., a basic agent or a user from a single group) sends a crafted PUT request to /api/v1/tickets/:id or /api/v2/tickets/batch supplying ObjectIds of tickets belonging to other groups. Because only the default tickets:update role grant is checked and no per-group ownership check is enforced, the server applies the changes, letting the attacker reassign, re-prioritize, alter, or mass-close tickets they should never touch. No public exploit artifact is flagged in the input, but a detailed technical write-up and exact source-line references are published, lowering the effort to reproduce.