CVE-2026-114397: Initialization of a Resource with an Insecure Default in polonel trudesk

CVE-2026-114397 affects Trudesk through version 1.2.11. The vulnerability arises from debug routes that are enabled without authentication if the environment variable NODE_ENV is not set. This missing authentication allows remote attackers to call the /debug/populatedb endpoint, which deletes all groups, tags, and tickets. Subsequently, attackers can log in using seeded accounts with the password 'password'. The CVSS 4.0 score is 8.3, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability.

An attacker can remotely invoke debug routes without authentication, leading to deletion of critical data such as groups, tags, and tickets. This compromises the integrity and availability of the Trudesk instance. Additionally, attackers can gain access by logging in with seeded accounts using a default password, further compromising system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that the NODE_ENV environment variable is properly set to disable debug routes or restrict access to debug endpoints. Avoid running Trudesk in an environment where NODE_ENV is unset.