CVE-2026-114400

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114401

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114402

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

CVE-2026-114399

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

CVE-2026-114395

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114398

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files serve...

CVE-2026-114394

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-114396

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or...

CVE-2026-114397

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODEENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the...

CVE-2026-114392

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...

CVE-2026-114393

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114402

The Trudesk application (versions through 1.2.11 ) is vulnerable to a path traversal and authorization bypass within the accountsController.uploadImage function. This flaw allows authenticated users to overwrite other users' avatars by manipulating form-supplied _id and username fields. Specifica...

CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114402 Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

EUVD-2026-107248

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114401

The Trudesk application (versions through 1.2.11 ) is vulnerable to a regular expression injection flaw in the POST /api/v1/login endpoint. This vulnerability allows unauthenticated attackers to perform username enumeration by submitting specific regex patterns, such as (admin|root) or a.*. By an...

EUVD-2026-107249

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

CVE-2026-114400 Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket...

CVE-2026-114400

Trudesk versions through 1.2.11 are vulnerable to a missing authentication flaw regarding ticket attachments. The root cause is that express.static serves the public/ directory before the hasAuth-guarded /uploads mount, allowing unauthenticated attackers to download private attachments. If an att...