Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2026 · NIST NVD

   Detected

   Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.

Sources

• CVE.orgVulnerability recordCVE-2026-111345

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-111345

  Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain fu

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · hackmd.io
• Reference · vulncheck.com