PT-2026-3886 · Tendenci · Tendenci

Nedlir · Published 2021-06-18 · Updated 2026-02-17 · CVE-2026-23946

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tendenci versions 15.3.11 and earlier

Description Tendenci, an open source content management system, has a critical deserialization issue in the Helpdesk module. An authenticated user with staff security level can achieve Remote Code Execution (RCE) due to the use of Python's pickle module in the helpdesk /reports/ functionality. The original vulnerability, addressed by CVE-2020-14942, was incompletely patched. While the ticket list() function was updated to use safe JSON deserialization, the run report() function continues to use the unsafe pickle.loads() function. The impact of a successful exploit is limited to the permissions of the user account running the application, typically www-data. The run report() function is located in tendenci/apps/helpdesk/views/staff.py.

Recommendations Update Tendenci to version 15.3.12 or later.

Exploit

Fix

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

CVE-2026-23946

GHSA-339M-4QW5-J2G3

GHSA-JQMC-FXXP-R589

Affected Products

Tendenci

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23946.json · Exploit
• https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3 · Vendor Advisory
• https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e · Patch
• https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1 · Patch
• https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636 · Patch
• https://github.com/tendenci/tendenci/issues/867 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23946 · Security Note
• https://osv.dev/vulnerability/GHSA-jqmc-fxxp-r589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14942 · Security Note
• https://osv.dev/vulnerability/GHSA-339m-4qw5-j2g3 · Vendor Advisory
• https://github.com/tendenci/tendenci · Note
• https://github.com/tendenci/tendenci/releases/tag/v15.3.12 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tendenci/PYSEC-2020-112.yaml · Note
• https://github.com/advisories/GHSA-jqmc-fxxp-r589 · Note