CVE-2026-111939
CVE-2026-111939 · Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
CVSS 5.1 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
helpdesk
- Versions
- ≥ 0, < 1.26.0: Affected (semver)
Update to 1.26.0
Original sources
- https://github.com/frappe/helpdesk/security/advisories/GHSA-xf93-jjcj-44vm
- https://github.com/frappe/helpdesk/commit/1186367f3616a605440e73e6a08eacbbcb9b92d9
- https://github.com/frappe/helpdesk/commit/c778f533b24b1dee0c75b206979a9bc4b1be0de2
- https://github.com/frappe/helpdesk/releases/tag/v1.26.0
- https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/api.py
- https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.py
- https://www.vulncheck.com/advisories/frappe-helpdesk-before-1.26.0-authorization-bypass-via-raised-by-in-ticket-creation
- https://nvd.nist.gov/vuln/detail/CVE-2026-111939