Trudesk through version 1.2.11 contains a missing authentication flaw that allows remote attackers to reach and invoke debug routes when the NODE_ENV variable is unset. By calling /debug/populatedb, an unauthenticated attacker can delete all groups, tags, and tickets, effectively destroying user data, and subsequently log in with the seeded accounts that are distributed with a default password of 'password', providing full access to the application. These actions enable data loss, unauthorized access, and potential further compromise.

Affected systems include the Trudesk project, version 1.2.11 or earlier, as identified by the vendor polonel. No other versions are listed as impacted, and the vulnerability is specific to the debug route implementation in the application code.

The vulnerability carries a high severity with a CVSS score of 8.3; the EPSS score is not available, and it is not yet catalogued in CISA's KEV. Exploitation is straightforward: an attacker only needs the ability to send authenticated HTTP requests to the hosted instance, and the missing authentication in the debug routes permits the exploitation without any credential. Because the routes are enabled only when NODE_ENV is unset, the attack vector is likely internal to the hosting environment or through a misconfigured environment exposing the debug endpoints to the internet.