CVE-2026-114395CWE-639

CVE-2026-114395

Medium · published October 21, 2026

CVSS v3.1

4.3

EPSS

Percentile

23.0

In the wild

Unconfirmed

What it is

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00313 · 23.0th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-10-21T17:18Z

References (5)

https://github.com/polonel/trudesk · [email protected]https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/messages.js#L183-L253 · [email protected]https://hackmd.io/@leediay/multiple-vuln-trudesk-1211 · [email protected]https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-api-v1-messages-send · [email protected]https://hackmd.io/@leediay/multiple-vuln-trudesk-1211 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

23 OCT 03:55Z
EPSS moved — → 0%
epss
21 OCT 12:39Z
Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
cvelistv5
21 OCT 12:39Z
Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
cvelistv5