The vulnerability exists in Trudesk versions up to 1.2.11, where an authorization check in the apiMessages.send handler is incomplete. The flaw allows a user who is already authenticated to submit a message with arbitrary owner and cId fields, enabling the creation of spoofed messages on behalf of other users. This leads to permission escalation within the messaging system, compromising the integrity of conversations and potentially exposing sensitive information.

Running Trudesk by polonel, specifically the Trudesk community edition up to version 1.2.11. The issue arises in the messaging API exposed at /api/v1/messages/send, and affects any deployment that has enabled that endpoint for authenticated users.

The CVSS base score of 5.3 indicates a moderate severity; the lack of an EPSS score and absence from the CISA KEV list suggest the exploit may not be widely documented or actively used. The attack requires an authenticated session, so the attack vector is inferred to be an internal or compromised user account and the vulnerability can be triggered by POSTing to the exposed endpoint with crafted JSON. For systems where the API is publicly exposed, the risk is heightened, especially if administrative credentials are reused.