PT-2026-3886 · Tendenci · Tendenci

Nedlir · CVE-2026-23946 · Published 2021-06-18 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tendenci versions 15.3.11 and earlier

Description Tendenci, an open source content management system, has a critical deserialization issue in the Helpdesk module. An authenticated user with staff security level can achieve Remote Code Execution (RCE) due to the use of Python's pickle module in the helpdesk /reports/ functionality. The original vulnerability, addressed by CVE-2020-14942, was incompletely patched. While the ticket list() function was updated to use safe JSON deserialization, the run report() function continues to use the unsafe pickle.loads() function. The impact of a successful exploit is limited to the permissions of the user account running the application, typically www-data. The run report() function is located in tendenci/apps/helpdesk/views/staff.py.

Recommendations Update Tendenci to version 15.3.12 or later.

Exploit

Fix

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

CVE-2026-23946

GHSA-339M-4QW5-J2G3

GHSA-JQMC-FXXP-R589

PYSEC-2026-1950

Affected Products

Tendenci

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23946.json · Exploit
• https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636 · Patch
• https://github.com/tendenci/tendenci/issues/867 · Vendor Advisory
• https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1 · Patch
• https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3 · Vendor Advisory
• https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e · Patch
• https://osv.dev/vulnerability/GHSA-339m-4qw5-j2g3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14942 · Security Note
• https://osv.dev/vulnerability/GHSA-jqmc-fxxp-r589 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23946 · Security Note
• https://github.com/tendenci/tendenci · Note
• https://github.com/tendenci/tendenci/releases/tag/v15.3.12 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tendenci/PYSEC-2020-112.yaml · Note