VULNERABILITY INTELLIGENCE

CVE-2026-114395

CVSS score5.3 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-10-21
Last modified2026-10-30
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.

Weakness classification

  • CWE-639: Authorization Bypass Through User-Controlled Key

Primary references