Description
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| polonel | trudesk | ≤ 1.2.11 | — |
References
- Zinea InfoSec Blog technical-description exploit
- GitHub Issue 754 issue-tracking
- Researcher Disclosure exploit technical-description
- VulnCheck Advisory: Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid third-party-advisory