CVE-2026-111939
Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
CVSS Score
4.6
EPSS Score
0.0%
EPSS Percentile
0th
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
| CWE | CWE-639 |
| Vendor | frappe |
| Product | helpdesk |
| Published | Oct 19, 2026 |
| Last Updated | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for frappe helpdesk
Be the first to know when new medium vulnerabilities affecting frappe helpdesk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
frappe / helpdesk
0 < 1.26.0
References
github.com: https://github.com/frappe/helpdesk/security/advisories/GHSA-xf93-jjcj-44vm github.com: https://github.com/frappe/helpdesk/commit/1186367f3616a605440e73e6a08eacbbcb9b92d9 github.com: https://github.com/frappe/helpdesk/commit/c778f533b24b1dee0c75b206979a9bc4b1be0de2 github.com: https://github.com/frappe/helpdesk/releases/tag/v1.26.0 github.com: https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/api.py github.com: https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.py vulncheck.com: https://www.vulncheck.com/advisories/frappe-helpdesk-before-1.26.0-authorization-bypass-via-raised-by-in-ticket-creation
Credits
George Chen