Trudesk versions through 1.2.11 allow an authenticated user to create ticket comments, internal notes, or tickets that appear to be authored by an arbitrary user. By providing a user‑controlled owner or ownerId in the API payloads, the request is processed without verifying that the acting user is permitted to set that value, which results in a clear authority escalation. The vulnerability is a classic authorization bypass flaw based on improper access control, leading to potential unauthenticated data manipulation, data integrity compromise, and misuse of privileged context.

The affected product is Trudesk, versions up to and including 1.2.11. No sub‑product or module variants are listed, and the impact applies to all installations of these versions that expose the public Ticket API endpoints.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the issue is not listed in the CISA KEV catalog. The likely attack vector is through the exposed API endpoints for ticket comments and creation; an attacker only needs valid authentication credentials to submit requests with a forged owner identifier. Upon exploitation an attacker could masquerade as a privileged user and inject content, potentially leading to social engineering or further compromise of the system.