polonel Trudesk up to 1.2.11 Ticket Update /api/v1/tickets/:id authorization

Summaryinfo

A vulnerability was found in polonel Trudesk up to 1.2.11 and classified as problematic. Impacted is an unknown function of the file /api/v1/tickets/:id of the component Ticket Update. Executing a manipulation of the argument ID can lead to authorization. This vulnerability is tracked as CVE-2026-114393. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in polonel Trudesk up to 1.2.11. This vulnerability affects an unknown code of the file /api/v1/tickets/:id of the component Ticket Update. The manipulation of the argument id with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect integrity, and availability. CVE summarizes:

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.

The advisory is shared for download at hackmd.io. This vulnerability was named CVE-2026-114393 since 10/21/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/21/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• polonel

Name

• Trudesk

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion