CVE-2026-23946

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23946", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T14:49:06.311Z", "datePublished": "2026-01-22T00:09:24.205Z", "dateUpdated": "2026-01-22T21:50:51.715Z"}, "containers": {"cna": {"title": "Tendenci has Authenticated Remote Code Execution via Pickle Deserialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3"}, {"name": "https://github.com/tendenci/tendenci/issues/867", "tags": ["x_refsource_MISC"], "url": "https://github.com/tendenci/tendenci/issues/867"}, {"name": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1", "tags": ["x_refsource_MISC"], "url": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1"}, {"name": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636", "tags": ["x_refsource_MISC"], "url": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636"}, {"name": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e", "tags": ["x_refsource_MISC"], "url": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e"}, {"name": "https://docs.python.org/3/library/pickle.html#restricting-globals", "tags": ["x_refsource_MISC"], "url": "https://docs.python.org/3/library/pickle.html#restricting-globals"}, {"name": "https://github.com/advisories/GHSA-jqmc-fxxp-r589", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-jqmc-fxxp-r589"}, {"name": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12"}], "affected": [{"vendor": "tendenci", "product": "tendenci", "versions": [{"version": "< 15.3.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T00:09:24.205Z"}, "descriptions": [{"lang": "en", "value": "Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12."}], "source": {"advisory": "GHSA-339m-4qw5-j2g3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T21:50:36.997181Z", "id": "CVE-2026-23946", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:50:51.715Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23946", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T21:50:36.997181Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:50:46.968Z"}}], "cna": {"title": "Tendenci has Authenticated Remote Code Execution via Pickle Deserialization", "source": {"advisory": "GHSA-339m-4qw5-j2g3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "tendenci", "product": "tendenci", "versions": [{"status": "affected", "version": "< 15.3.12"}]}], "references": [{"url": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3", "name": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tendenci/tendenci/issues/867", "name": "https://github.com/tendenci/tendenci/issues/867", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1", "name": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636", "name": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e", "name": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e", "tags": ["x_refsource_MISC"]}, {"url": "https://docs.python.org/3/library/pickle.html#restricting-globals", "name": "https://docs.python.org/3/library/pickle.html#restricting-globals", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/advisories/GHSA-jqmc-fxxp-r589", "name": "https://github.com/advisories/GHSA-jqmc-fxxp-r589", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12", "name": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T00:09:24.205Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23946", "state": "PUBLISHED", "dateUpdated": "2026-01-22T21:50:51.715Z", "dateReserved": "2026-01-19T14:49:06.311Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T00:09:24.205Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tendenci", "vendor": "tendenci", "versions": [{"status": "affected", "version": "< 15.3.12"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tendenci:tendenci:*:*:*:*:*:*:*:*", "matchCriteriaId": "830362AC-5281-471F-A3E9-830713123133", "versionEndExcluding": "15.3.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12."}, {"lang": "es", "value": "Tendenci es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto creado para organizaciones sin fines de lucro, asociaciones y sitios basados en causas. Las versiones 15.3.11 e inferiores incluyen una vulnerabilidad cr\u00edtica de deserializaci\u00f3n en el m\u00f3dulo Helpdesk (que no est\u00e1 habilitado por defecto). Esta vulnerabilidad permite la ejecuci\u00f3n remota de c\u00f3digo (RCE) por parte de un usuario autenticado con nivel de seguridad de personal debido al uso del m\u00f3dulo pickle de Python en helpdesk /reports/. El CVE-2020-14942 original se parche\u00f3 de forma incompleta. Aunque se corrigi\u00f3 ticket_list() para usar deserializaci\u00f3n JSON segura, la funci\u00f3n run_report() todav\u00eda usa pickle.loads() inseguro. El impacto est\u00e1 limitado a los permisos del usuario que ejecuta la aplicaci\u00f3n, t\u00edpicamente www-data, que generalmente carece de permisos de escritura (excepto para directorios de carga) y ejecuci\u00f3n. Este problema ha sido corregido en la versi\u00f3n 15.3.12."}], "id": "CVE-2026-23946", "lastModified": "2026-06-17T10:22:19.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23946", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T21:50:36.997181Z", "version": "2.0.3"}}]}, "published": "2026-01-22T01:15:52.467", "references": [{"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://docs.python.org/3/library/pickle.html#restricting-globals"}, {"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/advisories/GHSA-jqmc-fxxp-r589"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/tendenci/tendenci/issues/867"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:02:06.650586+00:00", "value": {"mitigation_remediation": ["Upgrade to Tendenci v15.3.12 or later where the run_report function has been removed.", "If updating immediately is not possible, disable the Helpdesk module or restrict access to the reports endpoint so that only trusted users can invoke it.", "Ensure the web server runs under a user with the minimal necessary privileges and review file permissions for upload directories; consider removing executable permissions from the web root if appropriate."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution (authenticated staff user)"}, "threat_synthesis": {"affected_systems": "The affected product is Tendenci CMS, versions 15.3.11 and earlier. The Helpdesk module is not enabled by default, but any deployment that has left the module active is vulnerable.", "description_and_impact": "Tendenci is an open\u2011source content management system. In versions 15.3.11 and older, the Helpdesk module contains a flaw that allows an authenticated user with staff privileges to run arbitrary code. The vulnerability stems from the run_report function, which deserializes user\u2011supplied data using Python\u2019s pickle.loads on the helpdesk /reports/ endpoint. Because pickle can instantiate any Python object, a crafted payload can cause the application to execute malicious code when it runs under the web server\u2019s user.", "risk_and_exploitability": "The CVSS base score is 6.8, indicating moderate severity. The EPSS score is below 1%, reflecting a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. The attack requires staff\u2011level authentication to access the report feature; once authenticated, the attacker can execute code with the privileges of the web server user, which typically cannot write or execute outside designated directories."}}}}, "created": "2026-01-22T10:08:10.822693+00:00", "updated": "2026-04-18T04:15:05.868125+00:00", "vendors": ["tendenci", "tendenci$PRODUCT$tendenci"]}