CVE-2026-111345 in Trudesk
Summary
by MITRE • 10/16/2026
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The Trudesk vulnerability identified in versions through 1.2.11 represents a critical failure in server-side access control mechanisms, specifically manifesting as an insecure direct object reference within the application's messaging subsystem. This flaw allows any authenticated user to bypass intended authorization checks by manipulating the unique identifier associated with private conversation threads. In standard secure implementations, when a user requests data for a specific resource such as a message thread or conversation, the server must verify that the requesting user is an authorized participant in that specific context before returning sensitive information. However, in this instance, the endpoint responsible for retrieving messages lacks these essential participant checks, effectively treating the conversation identifier as a public key rather than a protected reference tied to specific user permissions.
The technical root cause lies in the GET /api/v1/messages/conversation/:id API route, which accepts an arbitrary conversation ID provided by the client without validating whether that ID corresponds to a thread where the authenticated session holds membership rights. This architectural oversight means that if an attacker can guess or enumerate valid conversation IDs, they can retrieve the complete history of private communications intended for other users and organizations within the system. The absence of server-side validation transforms what should be a restricted operation into one accessible to any logged-in user, regardless of their role or relationship to the data being accessed. This type of vulnerability is commonly categorized under CWE-639, which addresses authorization bypass through direct object references, highlighting the critical need for explicit permission checks on every resource access request rather than relying solely on client-side restrictions or implicit trust in input parameters.
The operational impact of this vulnerability is severe due to the high sensitivity of the data exposed. By exploiting this flaw, an attacker can obtain full message histories from private conversations, which often contain confidential business discussions, internal troubleshooting details, and strategic planning information. Furthermore, the exposure extends beyond mere text content; the API response includes personally identifiable information such as usernames, full names, and email addresses associated with each participant in the conversation threads. This combination of sensitive communication logs and personal data creates a significant privacy violation and potential compliance risk for organizations using Trudesk to manage their IT service desk operations. The ability to scrape this data systematically could lead to social engineering attacks, corporate espionage, or further unauthorized access if additional credentials are discovered within the message content itself.
From an offensive security perspective, this vulnerability aligns with techniques described in the MITRE ATT&CK framework, particularly those related to Collection and Exfiltration of Data from Remote Systems. An attacker would likely engage in enumeration activities to identify valid conversation IDs before executing data retrieval operations against them. The lack of rate limiting or anomaly detection on these endpoints could facilitate large-scale harvesting of private communications over time without immediate triggering of security alerts. Organizations must recognize that authentication alone is insufficient for securing sensitive resources; robust authorization logic must be enforced at the application layer to ensure that users can only access data they are explicitly permitted to view based on their membership status within specific groups or tickets.
To mitigate this vulnerability, administrators should immediately upgrade Trudesk to version 1.2.12 or later, where the developers have implemented proper authorization checks for the conversation retrieval endpoint. Until an update is applied, organizations can implement compensating controls such as web application firewall rules that restrict access to sensitive API endpoints based on known attack patterns or by limiting exposure of internal services to trusted networks only. Additionally, implementing strict input validation and ensuring that all API routes perform server-side verification of user permissions against the requested resource ID are essential best practices for preventing similar authorization bypasses in future development cycles. Regular security audits focusing on access control logic can help identify such gaps before they are exploited by malicious actors seeking to compromise organizational confidentiality.