Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.
CVE-2026-114397
CVSS base score
7.4 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-1188
Last modified
October 30, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
trudesk project trudesk
References
- github.com Product
- github.com Patch
- github.com Patch
- hackmd.io Exploit, Third Party Advisory
- www.vulncheck.com Third Party Advisory
- hackmd.io Exploit, Third Party Advisory