CVE-2026-111939GHSA-xf93-jjcj-44vm
Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
frappe helpdesk
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.26.0helpdeskCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
Text from CVE List
Affected versions 1
- helpdeskaffected: all versions before 1.26.0CVE List
References 7
- github.com/frappe/helpdesk/commit/1186367f3616a605440e73e6a08eacbbcb9b92d9Fixvia CVE List
- github.com/frappe/helpdesk/commit/c778f533b24b1dee0c75b206979a9bc4b1be0de2Fixvia CVE List
- github.com/frappe/helpdesk/releases/tag/v1.26.0Fixvia CVE List
- github.com/frappe/helpdesk/security/advisories/GHSA-xf93-jjcj-44vmAdvisoryvia CVE List
- vulncheck.com/advisories/frappe-helpdesk-before-1.26.0-authorization-bypass-via-raised-by-in-ticket-creationAdvisoryvia CVE List
- github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/api.pyReferencevia CVE List
- github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.pyReferencevia CVE List