VULNERABILITY INTELLIGENCE

CVE-2026-114395

CVSS score5.3 MEDIUM

EPSS probability1.75%

CISA KEVNot currently listed

Published2026-10-21

Last modified2026-10-30

Description

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messag…