CVE-2026-114400 in Trudesk
Summary
by MITRE • 10/21/2026
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The Trudesk application version 1.2.11 suffers from a critical missing authentication vulnerability that stems from an incorrect configuration of static file serving middleware within its Express.js backend architecture. This flaw specifically impacts the handling of private ticket attachments stored in the /uploads directory, which are intended to be accessible only by authenticated users with appropriate permissions for specific tickets. The root cause lies in the order and precedence of route definitions or middleware mounting points where the public/ directory is served via express.static before the application logic that enforces authentication guards on the /uploads path takes effect. In Express.js applications, static file serving middleware often intercepts requests based on URL paths without executing subsequent route handlers or guard functions unless explicitly configured to do so through next() calls or specific error handling mechanisms. Because the public directory is mounted first and likely matches broader patterns or because the configuration fails to restrict access to the uploads folder properly, any request targeting a file within /uploads can be satisfied directly by the static server without triggering the authentication checks that would normally validate user session tokens or permissions.
This architectural misconfiguration allows unauthenticated attackers who possess knowledge of or can guess valid ticket ObjectIds and associated filenames to retrieve confidential attachments remotely. The vulnerability effectively bypasses the intended access control mechanisms, turning what should be a protected resource into publicly accessible data for anyone with network connectivity to the Trudesk instance. Attackers do not need valid credentials; they only require sufficient information about the internal structure of tickets, such as MongoDB ObjectIds which are often predictable or discoverable through enumeration techniques if other vulnerabilities exist, or simply by observing URLs in legitimate traffic if available. The impact is severe because ticket attachments frequently contain sensitive business documents, personal identifiable information, intellectual property, or credentials that were shared within the context of support requests.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-359 Exposure of Private Personal Information to an Unauthorized Actor. The failure to enforce authentication on sensitive endpoints represents a fundamental breakdown in security architecture where confidentiality controls are not applied consistently across all resource types within the application. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1078 Valid Accounts if we consider that attackers exploit the system's trust model by bypassing it entirely, or more accurately T1530 Data from Local System Extraction where data is exfiltrated without proper authorization checks. The specific mechanism of exploiting static file serving misconfigurations to access restricted directories is a common pattern in web application security flaws and highlights the importance of strict middleware ordering and explicit permission checks for all sensitive paths regardless of their physical location on the server filesystem.
Mitigation strategies must address both the immediate configuration error and broader architectural principles. The primary fix involves reordering the Express.js middleware stack to ensure that authentication guards or route-specific authorization logic are evaluated before static file serving attempts to resolve requests against protected directories like /uploads. Alternatively, developers should avoid using express.static for sensitive areas entirely and instead implement a dedicated controller function that checks user permissions via database queries against ticket ownership records before streaming any files from the disk. This ensures that every access request is validated against current session state and role-based access controls. Additionally, implementing strict input validation on file paths to prevent directory traversal attacks adds an extra layer of defense even if authentication were bypassed. Organizations running Trudesk 1.2.11 or earlier should upgrade immediately to a patched version where this routing logic has been corrected. Until upgrading is possible, network-level controls such as Web Application Firewalls can be configured to block direct access to the /uploads directory from unauthenticated sessions, although this is less robust than fixing the underlying application code. Regular security audits of middleware ordering and static file serving configurations are recommended to prevent similar issues in future development cycles.