CVE-2024-11146: TrueFiling authorization bypass via user-controlled keys

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-17 · updated 2026-06-17
Weakness: CWE-639

Description

TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.

Affected products

i3 Verticals TrueFiling: before 3.1.112.19 — fixed in 3.1.112.19

How to fix

Upgrade to a fixed version: i3 Verticals TrueFiling 3.1.112.19. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-11146 or the next vulnerability affects your stack