EUVD-2026-107241

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-114394

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-114394 Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-114394

Trudesk versions through 1.2.11 are vulnerable to an authorization bypass (CWE-639) within the Ticket Comment and Create APIs . The root cause allows authenticated users to supply user-controlled ownerId or owner parameters in postComment, postInternalNote, and ticket creation requests. This enab...