Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111345Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in trudesk from polonel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 80.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.

Affected products (as reported)

Vendor	Product	Versions
polonel	trudesk	0 – through 1.2.11

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/trudesk-conversation-messages-idor third-party-advisory
https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/messages.js#L255-L308 technical-description
https://github.com/polonel/trudesk/blob/v1.2.11/src/models/chat/message.js#L70-L101 technical-description
https://github.com/polonel/trudesk product
VulnCheck Advisory: Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id third-party-advisory