Description
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
polonel trudesk
Default version status: unaffected
0 to ≤ 1.2.11affected
pkg:github/polonel/trudeskReferences
- https://zineausa.com/blog/2026/10/trudesk-1-2-11-unauthorized-ticket-access-idor/ ↗
- https://github.com/polonel/trudesk/issues/754 ↗
- https://hackmd.io/@leediay/multiple-vuln-trudesk-1211 ↗
- https://www.vulncheck.com/advisories/trudesk-through-1.2.11-missing-authentication-for-ticket-attachments-via-uploads ↗