Platform
python
Component
tendenci
Fixed in
15.3.13
15.3.12
CVE-2026-23946 describes a critical Remote Code Execution (RCE) vulnerability found in the Tendenci Helpdesk module. This flaw allows an authenticated user with staff security level to execute arbitrary code by exploiting the /reports/ endpoint. The vulnerability impacts Tendenci versions 7.5.2 and earlier, stemming from the continued use of Python's pickle module for deserialization, a problem initially identified in CVE-2020-14942. A patch is available in version 15.3.12.
Successful exploitation of CVE-2026-23946 grants an attacker the ability to execute arbitrary code on the server running the Tendenci application. This could lead to complete system compromise, data exfiltration, and potential disruption of services. The scope of the attack is limited to the user account under which the Tendenci application runs, but this account often has significant privileges within the web hosting environment. The vulnerability's reliance on the pickle deserialization mechanism mirrors the risks associated with similar vulnerabilities like CVE-2020-14942, where malicious pickle files can be crafted to execute arbitrary commands. Given the module is not enabled by default, the immediate blast radius is reduced, but organizations that have enabled the Helpdesk module are at significant risk.
CVE-2026-23946 was publicly disclosed on 2026-01-21. The vulnerability builds upon a previously identified issue (CVE-2020-14942) that was not fully addressed. Public proof-of-concept exploits are likely to emerge given the vulnerability's nature and the availability of tools for crafting malicious pickle files. The EPSS score is likely to be assessed as Medium, reflecting the potential for RCE and the relatively straightforward exploitation process. Check CISA KEV for updates.
Exploit Status
EPSS
0.36% (58% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-23946 is to upgrade Tendenci to version 15.3.12 or later, which includes the necessary fix. If an immediate upgrade is not possible, consider temporarily disabling the Helpdesk module to reduce the attack surface. As a short-term workaround, implement strict input validation on the /reports/ endpoint to prevent the processing of potentially malicious data. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious pickle data. Monitor Tendenci application logs for unusual activity, particularly related to the /reports/ endpoint. After upgrading, confirm the vulnerability is resolved by attempting to trigger the report generation process with a known malicious pickle payload (in a controlled environment).
Update Tendenci CMS to version 15.3.12 or later. This version corrects the insecure deserialization vulnerability in the Helpdesk module. The update will prevent remote code execution by authenticated users with staff privileges.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-23946 is a Remote Code Execution vulnerability in the Tendenci Helpdesk module, allowing authenticated staff users to execute code via the /reports/ endpoint due to insecure pickle deserialization.
You are affected if you are using Tendenci versions 7.5.2 or earlier and have the Helpdesk module enabled. Even if the module is not enabled, review the code for potential vulnerabilities.
Upgrade Tendenci to version 15.3.12 or later. If immediate upgrade is not possible, disable the Helpdesk module or implement strict input validation.
While active exploitation is not confirmed, the vulnerability's nature and the availability of pickle exploitation techniques suggest it is likely to be targeted.
Refer to the official Tendenci security advisory on their website or through their security mailing list.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.