Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-111939Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Medium 4.6

In plain English

A medium-severity authorization bypass via user-controlled key in helpdesk from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.

Affected products (as reported)

Vendor	Product	Versions
frappe	helpdesk	0 – before 1.26.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-xf93-jjcj-44vm) vendor-advisory
https://github.com/frappe/helpdesk/commit/1186367f3616a605440e73e6a08eacbbcb9b92d9 patch
https://github.com/frappe/helpdesk/commit/c778f533b24b1dee0c75b206979a9bc4b1be0de2 patch
Frappe Helpdesk v1.26.0 Release Notes release-notes
https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/api.py technical-description
https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.py technical-description
VulnCheck Advisory: Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation third-party-advisory