CVE-2026-111345Medium· 4.3▾ SunlitTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114393Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
CVE-2026-114392Medium· 5.3Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
CVE-2026-114394Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
CVE-2026-114395Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
CVE-2026-114396High· 7.1Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
CVE-2026-114399Medium· 6.5Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API