CVE-2026-111939: Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Q: Who can exploit this issue?

An authenticated portal user can exploit it. The attacker must be able to call the hd_ticket.api.new endpoint and provide another customer's email address in the raised_by value.

Q: What can an attacker do after exploiting it?

They can create tickets that impersonate other customers, including phishing tickets placed in the victim's portal. They can also read replies to those tickets through get_ticket_activities.

Q: Which deployments are affected?

Frappe Helpdesk versions before 1.26.0 are affected. The provided information does not identify any configuration prerequisite beyond portal-user authentication.

Q: What should teams do if they cannot upgrade immediately?

The provided information does not specify a workaround. Until an upgrade is possible, restrict or closely monitor portal-user access and review ticket-creation requests for raised_by values that do not match the authenticated user.

Published Oct 19, 2026

Updated

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via getticketactivities.

Affected Software

1 affected component

Frappe HelpDesk<1.26.0

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated portal user can exploit it. The attacker must be able to call the hd_ticket.api.new endpoint and provide another customer's email address in the raised_by value.

What can an attacker do after exploiting it?

They can create tickets that impersonate other customers, including phishing tickets placed in the victim's portal. They can also read replies to those tickets through get_ticket_activities.

Which deployments are affected?

Frappe Helpdesk versions before 1.26.0 are affected. The provided information does not identify any configuration prerequisite beyond portal-user authentication.

What should teams do if they cannot upgrade immediately?

The provided information does not specify a workaround. Until an upgrade is possible, restrict or closely monitor portal-user access and review ticket-creation requests for raised_by values that do not match the authenticated user.

CVE-2026-111939: Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do after exploiting it?

Which deployments are affected?

What should teams do if they cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do after exploiting it?

Which deployments are affected?

What should teams do if they cannot upgrade immediately?