CVE-2026-111939

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...

CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...

CVE-2026-111939

Frappe Helpdesk versions prior to 1.26.0 are vulnerable to an authorization bypass (CWE-639). The flaw allows authenticated portal users to create tickets while impersonating other customers by providing a specific raised_by value when calling the hd_ticket.api.new endpoint. This allows an attack...

EUVD-2026-104312

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...