CVE-2026-114397highCWE-1188

CVE-2026-114397: high-severity vulnerability in polonel trudesk

Trudesk through 1.2.11 Missing Authentication on Debug Routes

Published · Updated

Follow this CVE+ Monitor trudesk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.6%
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
polonel · trudesk
Related CVEs — polonel trudesk

In the same product, most dangerous first.

CVE-2026-114399HIGHTrudesk through 1.2.11 Path Traversal via Backup Delete and Restore APIEPSS 0.6%CVE-2026-114396HIGHTrudesk through 1.2.11 MongoDB $where Injection via tickets search APIEPSS 0.5%CVE-2026-114400HIGHTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploadsEPSS 0.5%CVE-2026-114401MEDIUMTrudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/loginEPSS 0.4%CVE-2026-114392MEDIUMTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uidEPSS 0.4%CVE-2026-114402MEDIUMTrudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image UploadEPSS 0.4%