This vulnerability allows any authenticated user to modify tickets that belong to groups other than their own. By sending requests to the API endpoints PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch, an attacker can provide arbitrary ticket ObjectIds to change the status, subject, group, priority, or assignee of tickets and even close multiple tickets in one operation. The flaw occurs because only the default tickets:update role is checked, and no subsequent verification of group membership or ticket ownership is performed. Consequently, the attacker can compromise the integrity and confidentiality of ticket data and potentially disrupt workflow by altering or deleting tickets outside of their authorized scope.

The affected product is Trudesk as distributed by polonel. Versions up to and including 1.2.11 are vulnerable.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires a valid authenticated session but does not need any specialized skills; an attacker can construct malicious API requests to modify tickets. Because the flaw resides in the authorization checks of the ticket update endpoints, the risk is higher in deployments where these APIs are publicly exposed or where the default tickets:update role is granted broadly.