Key points
- Trudesk versions through 1.2.11 contain a missing authentication vulnerability rated CVSS 8.2.
- Attackers can access confidential attachments if they know or guess the ticket ObjectId and filename.
- The National Vulnerability Database records the flaw as CVE-2026-114400 with no confirmed fix yet.
Trudesk ticketing systems running versions up to 1.2.11 are affected by a high-severity authentication bypass. This flaw allows unauthenticated users to retrieve private ticket attachments hosted on the server.
What happened
The National Vulnerability Database lists CVE-2026-114400 as a high-severity issue with a CVSS score of 8.2. The weakness is classified under CWE-552 for missing authentication for a critical function. It affects all versions of the Trudesk application up to and including version 1.2.11.
The vulnerability arises from how the application serves static files. The express.static middleware serves the public directory before the authentication guard protects the uploads mount. This configuration error leaves private data exposed to unauthenticated requests.
An attacker does not need valid credentials to exploit this issue. They only need to know or guess the specific ticket ObjectId and the filename. Successful exploitation results in the direct download of confidential attachments stored in the uploads folder.
Why it matters
Security operations teams must treat this as a data exposure incident. The flaw allows complete bypass of authentication for specific file paths. Confidential business information contained in ticket attachments becomes accessible to anyone on the internet.
The impact is significant because the attack surface requires only a guessed identifier. There is no complex exploit chain or secondary vulnerability needed. Direct access to private files undermines the core confidentiality promise of the ticketing system.
What happens next
- Identify all instances of Trudesk version 1.2.11 and earlier in your environment.
- Check web server logs for requests to the uploads directory without prior authentication.
- Monitor for unusual download patterns or access from unexpected IP addresses.
- Restrict network access to the Trudesk interface until a mitigation is confirmed.
Patch priority
Teams should prioritise systems exposed to the public internet for immediate review. Check whether internal network segmentation limits access to the affected upload endpoints. Back up configuration files before making any manual adjustments to the web server. Test any temporary restrictions in a non-production environment first. Verify that authentication logs capture all requests to the uploads path. Monitor traffic for signs of automated scanning or directory traversal attempts.
What to do and how to stay safe: Trudesk
- Restrict inbound traffic to the Trudesk web interface using firewall rules or WAF policies.
- Audit access logs to identify any unauthenticated requests to the uploads directory.
- Rotate credentials or tokens if private data in attachments was potentially compromised.
- Watch for vendor updates and apply them once a confirmed fix is released.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Trudesk are affected by this vulnerability?
All versions of Trudesk up to and including version 1.2.11 are affected by this flaw.
Is there a patch available for CVE-2026-114400?
No fix has been confirmed yet by the vendor or in the source material.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates the severity as 8.2, which is high.
