Key points
- Trudesk versions up to 1.2.11 are affected by CVE-2026-114397.
- The flaw has a CVSS score of 8.3, rated as high severity.
- Attackers can reset the database and log in with a default password.
Trudesk help desk software versions through 1.2.11 contain a security gap that allows unauthorized users to destroy data. The vulnerability, identified as CVE-2026-114397, affects any installation where the NODE_ENV variable is not set. This configuration mistake exposes debug routes to the public internet without requiring a login.
In plain English
The issue stems from missing authentication on specific debug endpoints. When the system environment variable NODE_ENV is unset, these internal routes become accessible to anyone. An attacker does not need a username or password to reach them. They can simply send a request to the server to trigger destructive actions. This bypasses all standard security checks that normally protect user accounts and data.
The background
According to the National Vulnerability Database record, the flaw is categorized under CWE-1188. It is rated with a CVSS score of 8.3, which places it in the high severity range. The vulnerability exists in Trudesk builds released up to version 1.2.11. The specific risk involves the /debug/populatedb endpoint, which is intended for setup or testing but remains active in improper configurations.
What changes now
Attackers can exploit this by calling the populatedb endpoint. This action deletes all existing groups, tags, and tickets in the system. After wiping the data, the system creates new seeded accounts. These new accounts use the password 'password' by default. An attacker can then log in with these credentials to take full control of the compromised help desk instance.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks. Check whether the NODE_ENV variable is properly configured on all servers. Isolate vulnerable instances from external access until a fix is confirmed. Back up all ticket data and configuration files immediately. Test any mitigation steps in a non-production environment first. Monitor server logs for unusual requests to debug endpoints. Limit access to administrative interfaces using network-level restrictions. Verify that all user accounts use strong, unique passwords to prevent easy takeover after a data reset event.
What to do and how to stay safe: Trudesk
- Verify if your Trudesk installation has the NODE_ENV variable unset.
- Ensure the /debug/populatedb endpoint is not accessible from the internet.
- Monitor server logs for unauthorized access attempts to debug routes.
- Back up all ticket data and user configurations immediately.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Trudesk are affected?
Trudesk versions through 1.2.11 are affected by this vulnerability.
What is the severity score?
The flaw has a CVSS score of 8.3, rated as high.
Can attackers log in after wiping the data?
Yes, they can log in with seeded accounts using the password 'password'.
