The vulnerability in Trudesk versions up to 1.2.11 allows any user who has authenticated to browse private conversations by specifying any conversation identifier in the GET request to /api/v1/messages/conversation/:id. The missing participant validation means the request returns the entire message history for that conversation, as well as the usernames, full names, and e‑mail addresses of all participants. The flaw constitutes an authorization bypass that exposes sensitive personal and communication data, raising confidentiality risks for all involved users. The weakness is mapped to CWE-639, which classifies it as insufficient authorization checks.

Polonel’s Trudesk project is affected for all releases up to and including version 1.2.11. Instances running Trudesk 1.2.11 or earlier are at risk. The issue remains in any environment that has not been upgraded beyond 1.2.11.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score of 0.00269 (~0.27%) indicates a very low probability of exploitation. The entry is not listed in the CISA KEV catalog, so widespread exploitation is unlikely; however, any authenticated attacker can exploit the flaw. The attack vector is internal to the application: an authenticated session is required to claim a conversation ID. Once authenticated, an attacker can freely request any conversation ID and gain access to third‑party personal data and message content. The impact is limited to confidentiality and does not involve execution, modification, or availability denial.