CVE-2026-114397

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.

• CWE-1188

• https://github.com/polonel/trudeskProduct
• https://github.com/polonel/trudesk/blob/v1.2.11/app.js#L32Patch
• https://github.com/polonel/trudesk/blob/v1.2.11/src/routes/index.js#L398-L433Patch
• https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory
• https://www.vulncheck.com/advisories/trudesk-through-1.2.11-missing-authentication-on-debug-routesThird Party Advisory
• https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114391ZenTao PMS before 22.3 contains an authorization bypass vuln…7.1
• CVE-2026-114392Trudesk through 1.2.11 contains an authorization bypass vuln…5.3
• CVE-2026-114393Trudesk through 1.2.11 contains an authorization bypass vuln…4.3
• CVE-2026-114394Trudesk through 1.2.11 contains an authorization bypass vuln…4.3
• CVE-2026-114395Trudesk through 1.2.11 contains an authorization bypass vuln…4.3
• CVE-2026-114396Trudesk through 1.2.11 contains a server-side JavaScript inj…7.1
• CVE-2026-114398Trudesk through 1.2.11 contains an unrestricted file upload …5.4
• CVE-2026-114399Trudesk through 1.2.11 contains a path traversal vulnerabili…6.5
• CVE-2026-1144A vulnerability was detected in quickjs-ng quickjs up to 0.1…8.8
• CVE-2026-11440A vulnerability was determined in theonedev onedev up to 15.…6.3
• CVE-2026-114400Trudesk through 1.2.11 contains a missing authentication vul…7.5
• CVE-2026-114401Trudesk through 1.2.11 contains a regular expression injecti…5.3