CVE-2026-114401: Improper Neutralization of Special Elements in Data Query Logic in polonel trudesk

CVE-2026-114401 describes a regular expression injection vulnerability in polonel's Trudesk product through version 1.2.11. The flaw exists in the POST /api/v1/login endpoint, where unauthenticated attackers can submit regex patterns such as alternations or prefixes (e.g., (admin|root), a.*) to enumerate valid usernames. The application responds differently to invalid usernames versus invalid passwords, enabling attackers to distinguish valid accounts. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

An attacker can enumerate valid usernames without authentication by exploiting the regex injection flaw in the login API. This information disclosure can facilitate further targeted attacks such as password guessing or social engineering. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing rate limiting or monitoring for suspicious login attempts to reduce enumeration risk.