CVE-2026-111345 Details

An authorization bypass vulnerability has been identified in Trudesk versions through 1.2.11. This vulnerability allows any authenticated user to access private conversations by providing the conversation's ID. The issue arises in the messaging API, specifically the route GET /api/v1/messages/conversation/:id, which fails to verify if the user is a participant in the conversation. As a result, users can retrieve the full message history of private conversations between other users, including sensitive information such as usernames, full names, and email addresses.

The vulnerability can be addressed by adding a participant membership check to the getMessagesForConversation handler, similar to the existing check in the deleteConversation handler. Additionally, the message model query should be modified to enforce membership verification before allowing access to conversation messages.