Polonel Trudesk up to 1.2.11 Ticket Retrieval /api/v1/tickets/:uid apiTickets.single authorization

Summaryinfo

A vulnerability was found in Polonel Trudesk up to 1.2.11. It has been classified as problematic. The affected element is the function apiTickets.single of the file /api/v1/tickets/:uid of the component Ticket Retrieval. The manipulation leads to authorization. This vulnerability is listed as CVE-2026-114392. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Polonel Trudesk up to 1.2.11. This issue affects the function apiTickets.single of the file /api/v1/tickets/:uid of the component Ticket Retrieval. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is confidentiality. The summary by CVE is:

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.

The advisory is shared at hackmd.io. The identification of this vulnerability is CVE-2026-114392 since 10/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Polonel

Name

• Trudesk

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion