CVE-2026-111939
Received Received - Intake

Authorization Bypass in Frappe Helpdesk Allows Ticket Impersonation

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111939
EUVD
EUVD-2026-104312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe helpdesk 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Frappe Helpdesk before version 1.26.0 has an authorization bypass flaw. Authenticated portal users can create tickets under another customer's identity by setting a raised_by value. This allows attackers to impersonate victims by submitting their email to the hd_ticket.api.new endpoint.

Detection Guidance

Check Frappe Helpdesk logs for API calls to hd_ticket.api.new with a raised_by parameter set to a different user's email. Monitor portal ticket creation events for unexpected customer impersonations.

Impact Analysis

Attackers can plant phishing tickets in a victim's portal. They may read the victim's replies to these tickets, potentially gaining access to sensitive information or tricking the victim into taking harmful actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Attackers can impersonate users to plant phishing tickets and access their replies, potentially exposing confidential data.

Mitigation Strategies

Upgrade Frappe Helpdesk to version 1.26.0 or later. Review and restrict portal user permissions to prevent unauthorized ticket creation. Implement input validation to block email spoofing in the raised_by field.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111939. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart