Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
CVE-2026-114400
CVSS base score
5.9 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-552
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
trudesk project trudesk
References
- github.com Issue Tracking
- hackmd.io Exploit, Third Party Advisory
- www.vulncheck.com Third Party Advisory
- zineausa.com Exploit, Third Party Advisory
- hackmd.io Exploit, Third Party Advisory