Live › vulnerability › CVE-2026-111939
Go to dashboardFrappe Helpdesk before 1.26.0 lets an authenticated portal user set the raised_by field when creating a ticket, so the ticket is filed under another customer's email. The same flaw lets the attacker plant phishing tickets in a victim's portal and read the victim's replies through get_ticket_activities.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Frappe Helpdesk before 1.26.0 with customer portal logins enabled, since any portal account can take part in the attack. Internal-only deployments where no external users hold portal accounts have a much smaller exposure, but the upgrade is still the fix.
No product ranges from the sources yet.
bench version or the app list in the Frappe bench) and confirm it is below 1.26.01.26.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
This page as .md · .json · in your agent: get_signal("CVE-2026-111939")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.