Medium severity · published Oct 15, 2026
CVE-2026-111345
Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trudesk · polonel
through 1.2.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111345
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111345
github.com
https://github.com/polonel/trudesk
github.com
https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/messages.js#L255-L308
github.com
https://github.com/polonel/trudesk/blob/v1.2.11/src/models/chat/message.js#L70-L101
hackmd.io
https://hackmd.io/@hieuPenguinnn/trudesk-conversation-messages-idor
www.vulncheck.com
https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-get-api-v1-messages-conversation-id
More from trudesk
7.4
CVE-2026-114397
Trudesk through 1.2.11 Missing Authentication on Debug Routes
7.1
CVE-2026-114396
Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
6.5
CVE-2026-114399
Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
5.9
CVE-2026-114400
Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
5.4
CVE-2026-114398
Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo