CVE-2020-11466

An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve arbitrary information about all helpdesk tickets stored in database with numerous filters. This leaked sensitive information to unauthorized parties. Additionally, it leaked ticket authentication code, making it possible to make changes to a ticket.

• CWE-269

• https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory
• https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/Exploit, Third Party Advisory
• https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09Release Notes, Vendor Advisory
• https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-updateRelease Notes, Vendor Advisory

Published

Apr 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11458app/Model/feed.php in MISP before 2.4.124 allows administrat…4.9
• CVE-2020-1146<p>An elevation of privilege vulnerability exists when the M…6.6
• CVE-2020-11462An issue was discovered in OpenVPN Access Server before 2.7.…7.5
• CVE-2020-11463An issue was discovered in Deskpro before 2019.8.0. The /api…7.5
• CVE-2020-11464An issue was discovered in Deskpro before 2019.8.0. The /api…4.3
• CVE-2020-11465An issue was discovered in Deskpro before 2019.8.0. The /api…8.8
• CVE-2020-11467An issue was discovered in Deskpro before 2019.8.0. This pro…7.2
• CVE-2020-11469Zoom Client for Meetings through 4.6.8 on macOS copies runwi…7.8
• CVE-2020-1147A remote code execution vulnerability exists in .NET Framewo…7.8
• CVE-2020-11470Zoom Client for Meetings through 4.6.8 on macOS has the disa…3.3
• CVE-2020-11474NCP Secure Enterprise Client before 10.15 r47589 allows a sy…7.8
• CVE-2020-11476Concrete5 before 8.5.3 allows Unrestricted Upload of File wi…7.2