CVE-2026-23946: Tendenci Helpdesk Module Vulnerability Leading to Authenticated Remote Code Execution
Summary
CVE-2026-23946: Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization. Affects tendenci versions < 15.3.12. Fixed in 15.3.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tendenci is an open-source software platform designed for managing membership-based organizations. It provides various functionalities, including event management, membership management, and a helpdesk module for support ticketing. The helpdesk module, while not enabled by default, allows staff members to manage support tickets. However, it has been found to be vulnerable to a critical deserialization issue that can lead to remote code execution if exploited by an authenticated user.
Vulnerability Detail
A critical deserialization vulnerability exists in the Tendenci Helpdesk module, affecting versions 15.3.11 and earlier. This vulnerability allows remote code execution (RCE) through the use of Python's pickle module in the 'run_report()' function, which has not been properly patched following the original CVE-2020-14942. The flaw can be exploited by an authenticated user with staff security level, potentially allowing them to execute arbitrary code within the context of the application. The impact is limited to the permissions of the user running the application, typically 'www-data'.
How To Fix
Minimum fixed version
15.3.12
This is the first release that contains the fix.
pip install --upgrade "tendenci==15.3.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the Helpdesk module if it is not essential for your operations until the package can be updated.
Conclusion
The Tendenci Helpdesk module is vulnerable to a critical deserialization issue that can lead to remote code execution by authenticated users. It is crucial to update to the latest version to mitigate this risk. Users should also consider disabling the Helpdesk module if immediate updates are not feasible.
See every vulnerability recorded for tendenci →
FAQ
CVE-2026-23946 is a vulnerability in the Tendenci Helpdesk module that allows authenticated users to execute arbitrary code due to unsafe deserialization.
Tendenci versions 15.3.11 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider disabling the Helpdesk module as a temporary workaround.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for tendenci.
