CVE-2026-114400
5.9 MEDIUMpublic exploit availablePublished 2026-10-21 · Updated 2026-10-23
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-552
Public exploit & PoC references
All references
- https://github.com/polonel/trudesk/issues/754
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-missing-authentication-for-ticket-attachments-via-uploads
- https://zineausa.com/blog/2026/10/trudesk-1-2-11-unauthorized-ticket-access-idor/
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100727
- HIGHCVE-2026-102695PoC
- MEDIUMCVE-2026-105750PoC
- UNSCOREDCVE-2026-108070
- MEDIUMCVE-2026-108938PoC
- UNSCOREDCVE-2026-109162PoC
- MEDIUMCVE-2026-112144PoC
- MEDIUMCVE-2026-112948PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.