Read the docs
TI-2024-10330 Aliases CVE-2024-11146GHSA-h44w-w4w4-cjc2

TrueFiling authorization bypass via user-controlled keys

Priority LOW 34CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 28th percentileScored 2026-11-07
Fix Fixed TrueFiling (i3 Verticals): 3.1.112.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
i3 VerticalsTrueFilingbefore 3.1.112.193.1.112.19Patch availableCNA
  • TrueFiling Vendori3 Verticals Affected before 3.1.112.19 Fixed in 3.1.112.19 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:i3verticals:truefiling:*:*:*:*:*:*:*:*before 3.1.112.19Vulnerablei3 Verticals
  • cpe:2.3:a:i3verticals:truefiling:*:*:*:*:*:*:*:* Versions before 3.1.112.19 Vulnerable ·i3 Verticals

Remediation

  • Fix · CNA TrueFiling (i3 Verticals) Fixed in 3.1.112.19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11146
  2. 2026-10-03 Alias added: GHSA-h44w-w4w4-cjc2

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences