Trudesk versions up to 1.2.11 contain a missing authentication protection that lets an attacker guess a ticket ObjectId and filename to download private attachments stored under the /uploads directory. Because the express.static middleware serves the public folder before the authentication‑guarded /uploads mount, the application inadvertently exposes confidential files to unauthenticated users. This flaw maps to CWE‑552, which indicates a failure to enforce access control for files.

The vendor Polonel Trudesk is affected. All releases of the Trudesk product through version 1.2.11 are vulnerable. Administrators using Trudesk 1.2.11 or earlier should verify their deployment and plan for remediation.

The CVSS score of 8.2 marks the flaw as high severity. Attackers only need to know or guess a ticket ObjectId and attachment filename; no authentication is required. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation and potential for confidential data disclosure warrants immediate action.