CVE-2026-114395 in Trudesk
Summary
by MITRE • 10/21/2026
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Trudesk versions through 1.2.11 represents a critical authorization bypass within the application's messaging subsystem, specifically targeting the apiMessages.send endpoint. This flaw is directly related to an incomplete remediation of CVE-2022-1931, indicating that previous security patches failed to fully address the underlying logic errors governing user identity and message ownership. The core technical issue stems from insufficient validation of input parameters during the creation of new messages. Specifically, the application fails to enforce server-side checks on the owner identifier and conversation ID (cId) provided by the authenticated client. Instead of deriving these values strictly from the session context or database records associated with the currently logged-in user, the API accepts arbitrary values supplied in the POST request body. This design flaw allows an attacker who has valid authentication credentials to manipulate the message metadata, effectively impersonating other users and injecting content into conversations where they have no legitimate access rights.
From a technical perspective, this vulnerability is classified under CWE-269, which covers Improper Privilege Assignment, as well as CWE-862, Missing Authorization Check. The attacker exploits the lack of strict binding between the authenticated session and the resource being modified. By supplying arbitrary owner IDs, the malicious actor can set the sender field of a message to match any other user in the system. Simultaneously, by providing an unauthorized cId, they bypass access control lists that would normally restrict visibility or participation in specific support tickets or conversations. This mechanism effectively neutralizes the intended security controls because the application trusts client-supplied identifiers over server-side state verification. The incomplete fix for CVE-2022-1931 suggests a regression or oversight where partial hardening was applied, perhaps restricting some aspects of message creation but leaving this specific vector open to manipulation.
The operational impact of this vulnerability is severe due to the potential for social engineering and data integrity compromise within the Trudesk platform. Since Trudesk is often used as an IT service management tool handling sensitive organizational information, the ability to spoof messages allows attackers to disrupt workflows, spread misinformation among team members, or manipulate ticket statuses by injecting fraudulent updates. An attacker could pose as a system administrator or a senior engineer to issue misleading instructions or delete critical context from conversations they are not part of. This undermines trust in the communication channel and can lead to significant operational disruptions if automated processes rely on message content for triggering actions. Furthermore, this activity may go undetected by standard audit logs that simply record the action without verifying the authenticity of the sender identity against the actual session holder.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK techniques such as T1078 Valid Accounts and T1564 Hide Artifacts or T1098 Manipulated Account depending on how the spoofed messages are utilized for persistence or evasion. The exploitation requires authenticated access, which limits the attack surface to insiders or users whose credentials have been compromised via phishing or credential stuffing attacks. However, once an attacker gains this level of access, the ability to impersonate others escalates their privileges significantly without needing further exploits. This lateral movement capability within the application layer can facilitate broader compromises if Trudesk is integrated with other systems that trust its API outputs for automation purposes.
Mitigation strategies must focus on enforcing strict server-side validation and ensuring complete remediation of prior vulnerabilities. The most effective immediate mitigation is to upgrade Trudesk to a version later than 1.2.11 where the authorization logic has been fully corrected. If upgrading is not immediately feasible, administrators should implement web application firewall rules that inspect POST requests to /api/v1/messages/send for anomalies in owner and cId fields relative to the authenticated user's profile. Additionally, enabling comprehensive audit logging that records both the requesting user ID and the message sender ID can help detect exploitation attempts by highlighting discrepancies between the two values. Long-term remediation requires a code review of the messaging module to ensure all resource access checks are performed against server-side state rather than client-supplied data, adhering to the principle of least privilege and secure defaults as outlined in OWASP guidelines for API security.