CVE-2026-114401

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.

• CWE-943

• https://github.com/polonel/trudeskProduct
• https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/common.js#L45-L65Patch
• https://github.com/polonel/trudesk/blob/v1.2.11/src/models/user.js#L310-L319Patch
• https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory
• https://www.vulncheck.com/advisories/trudesk-through-1.2.11-username-enumeration-via-regex-injection-in-api-v1-loginThird Party Advisory
• https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory

Published

Oct 21, 2026

Last Modified

Oct 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114397Trudesk through 1.2.11 contains a missing authentication vul…7.4
• CVE-2026-114398Trudesk through 1.2.11 contains an unrestricted file upload …5.4
• CVE-2026-114399Trudesk through 1.2.11 contains a path traversal vulnerabili…6.5
• CVE-2026-1144A vulnerability was detected in quickjs-ng quickjs up to 0.1…8.8
• CVE-2026-11440A vulnerability was determined in theonedev onedev up to 15.…6.3
• CVE-2026-114400Trudesk through 1.2.11 contains a missing authentication vul…7.5
• CVE-2026-114402Trudesk through 1.2.11 contains a path traversal and authori…4.3
• CVE-2026-114403PHPOffice PHPPresentation through 1.2.0 contains an insecure…8.1
• CVE-2026-114404PHPOffice PHPPresentation 1.2.0 contains a cross-site script…6.1
• CVE-2026-114405Improper validation of array index vulnerability in Velneo v…8.7
• CVE-2026-114406The system certificate authority (CA) store in Red Hat produ…6.8
• CVE-2026-114407e107 CMS before 2.3.13 contains a reflected cross-site scrip…6.1