CVE-2026-23946 (GCVE-0-2026-23946)
Vulnerability from cvelistv5
Published
2026-01-22 00:09
Modified
2026-01-22 21:50
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T21:50:36.997181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T21:50:51.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tendenci",
"vendor": "tendenci",
"versions": [
{
"status": "affected",
"version": "\u003c 15.3.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python\u0027s pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T00:09:24.205Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3"
},
{
"name": "https://github.com/tendenci/tendenci/issues/867",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/issues/867"
},
{
"name": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1"
},
{
"name": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636"
},
{
"name": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e"
},
{
"name": "https://docs.python.org/3/library/pickle.html#restricting-globals",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.python.org/3/library/pickle.html#restricting-globals"
},
{
"name": "https://github.com/advisories/GHSA-jqmc-fxxp-r589",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/advisories/GHSA-jqmc-fxxp-r589"
},
{
"name": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12"
}
],
"source": {
"advisory": "GHSA-339m-4qw5-j2g3",
"discovery": "UNKNOWN"
},
"title": "Tendenci has Authenticated Remote Code Execution via Pickle Deserialization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23946",
"datePublished": "2026-01-22T00:09:24.205Z",
"dateReserved": "2026-01-19T14:49:06.311Z",
"dateUpdated": "2026-01-22T21:50:51.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23946\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-22T21:50:36.997181Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-22T21:50:46.968Z\"}}], \"cna\": {\"title\": \"Tendenci has Authenticated Remote Code Execution via Pickle Deserialization\", \"source\": {\"advisory\": \"GHSA-339m-4qw5-j2g3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"tendenci\", \"product\": \"tendenci\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 15.3.12\"}]}], \"references\": [{\"url\": \"https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3\", \"name\": \"https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/tendenci/tendenci/issues/867\", \"name\": \"https://github.com/tendenci/tendenci/issues/867\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1\", \"name\": \"https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636\", \"name\": \"https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e\", \"name\": \"https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://docs.python.org/3/library/pickle.html#restricting-globals\", \"name\": \"https://docs.python.org/3/library/pickle.html#restricting-globals\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/advisories/GHSA-jqmc-fxxp-r589\", \"name\": \"https://github.com/advisories/GHSA-jqmc-fxxp-r589\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/releases/tag/v15.3.12\", \"name\": \"https://github.com/tendenci/tendenci/releases/tag/v15.3.12\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python\u0027s pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-22T00:09:24.205Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-23946\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-22T21:50:51.715Z\", \"dateReserved\": \"2026-01-19T14:49:06.311Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-22T00:09:24.205Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…