CVE-2026-23946

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module which is not enabled by default. This vulnerability allows Remote Code Execution RCE b...

CVE-2026-23946

Tendenci 15.3.11 and earlier contains a critical deserialization vulnerability in the Helpdesk module that enables authenticated RCE via Python pickle loads in helpdesk/reports/. While ticket_list() uses safe JSON deserialization, run_report() still relies on pickle.loads(), exposing impact limit...

GHSA-339M-4QW5-J2G3 Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

A critical deserialization vulnerability exists in Tendenci Helpdesk module NOTE, by default, Helpdesk is NOT enabled, affecting the version 15.3.11 and earlier. This vulnerability allows remote code execution RCE by an authenticated user with staff security level due to using Python's pickle...