CVE-2026-111939
Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 19, 2026
- Updated
- Oct 19, 2026
- Reserved
- Oct 17, 2026
Description
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
helpdeskfrappe |
|
References
- GitHub Security Advisory (GHSA-xf93-jjcj-44vm)vendor-advisory
- https://github.com/frappe/helpdesk/commit/1186367f3616a605440e73e6a08eacbbcb9b92d9patch
- https://github.com/frappe/helpdesk/commit/c778f533b24b1dee0c75b206979a9bc4b1be0de2patch
- Frappe Helpdesk v1.26.0 Release Notesrelease-notes
- https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/api.pytechnical-description
- https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.pytechnical-description
- VulnCheck Advisory: Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.