Trudesk v1.2.11 contains an authorization bypass flaw that allows an authenticated user to read ticket data that belongs to other groups. The API endpoint GET /api/v1/tickets/:uid does not verify group membership before returning ticket subject, issue, comments, owner and assignee. Because ticket identifiers are sequential, attackers can enumerate tickets by incrementing the uid and extract confidential information from each ticket.

The vulnerability affects Trudesk Project installations running version 1.2.11 or earlier; any user with authenticated access to the system is able to exploit the flaw regardless of group membership, as the package author "polonel" publishes the affected code in the GitHub repository identified by the CPE string.

The CVSS score of 5.3 indicates a moderate severity that permits information disclosure. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog, suggesting that it may not yet be actively exploited. The attack vector is inferred to be a standard HTTP request to the ticket API endpoint, requiring only authenticated credentials. Without additional safeguards, an attacker can obtain full ticket content by iterating uid values.