Trudesk versions through 1.2.11 contain a regular expression injection flaw in the login API that allows an unauthenticated attacker to distinguish valid usernames from invalid ones by sending crafted regular expression patterns to POST /api/v1/login. The server responds with a distinguishable"Invalid User" or "Invalid Password" message, enabling the attacker to enumerate accounts. This information disclosure could be used to target real users, facilitate phishing, or serve as the first step toward credential‑based attacks. The vulnerability is grounded in CWE‑943, an unauthorized symbolic reference flaw where special characters are misinterpreted as code.

Trudesk – polonel:trudesk, version 1.2.11 and any earlier releases. The flaw exists in the /api/v1/login endpoint and all affected builds that have not been updated to a patched release. Users running the vulnerable application on any platform where the API is exposed are at risk.

The CVSS score of 6.9 indicates moderate severity, reflecting the ease with which the flaw can be exploited for username enumeration. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, so the probability of widespread exploitation is unclear. The likely attack vector is the public-facing web API, requiring no authentication, and the attacker only needs to send HTTP POST requests with crafted regex payloads. Successful exploitation does not grant any privileges directly but reveals sensitive identifier information used in further attacks.