CVE-2026-23946

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23946
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23946.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23946
Aliases
Related
Published
2026-01-22T00:09:24.205Z
Modified
2026-02-19T00:36:38.077553Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Tendenci has Authenticated Remote Code Execution via Pickle Deserialization
Details

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticketlist() was fixed to use safe JSON deserialization, the runreport() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23946.json",
    "cwe_ids": [
        "CWE-502",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/tendenci/tendenci

Affected ranges

Type
GIT
Repo
https://github.com/tendenci/tendenci
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2862cc70592ed056b8380a3167b6006cc0cf79d2

Affected versions

11.*
11.4.3
v11.*
v11.0
v11.0.1
v11.0.2
v11.0.3
v11.0.4
v11.0.5
v11.0.6
v11.0.7
v11.0.8
v11.1
v11.1.1
v11.1.2
v11.2
v11.2.1
v11.2.10
v11.2.11
v11.2.12
v11.2.2
v11.2.3
v11.2.4
v11.2.5
v11.2.6
v11.2.7
v11.2.8
v11.2.9
v11.3
v11.3.1
v11.4
v11.4.1
v11.4.10
v11.4.2
v11.4.4
v11.4.5
v11.4.6
v11.4.7
v11.4.8
v11.4.9
v12.*
v12.0
v12.0.1
v12.0.10
v12.0.11
v12.0.12
v12.0.13
v12.0.14
v12.0.2
v12.0.3
v12.0.4
v12.0.5
v12.0.6
v12.0.7
v12.0.8
v12.0.9
v12.1
v12.1.1
v12.2
v12.2.1
v12.2.2
v12.2.3
v12.2.5
v12.2.6
v12.2.7
v12.2.8
v12.3
v12.3.1
v12.3.2
v12.3.3
v12.4
v12.4.1
v12.4.10
v12.4.12
v12.4.13
v12.4.2
v12.4.3
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v12.5.1
v12.5.10
v12.5.11
v12.5.2
v12.5.3
v12.5.4
v12.5.5
v12.5.6
v12.5.7
v12.5.8
v12.5.9
v14.*
v14.0
v14.0.1
v14.0.2
v14.0.3
v14.0.4
v14.1
v14.1.1
v14.2
v14.3
v14.3.1
v14.3.2
v14.3.3
v14.3.4
v14.3.5
v14.3.6
v14.4
v14.5
v14.5.1
v14.8
v14.8.1
v15.*
v15.0
v15.1
v15.2
v15.2.1
v15.3
v15.3.1
v15.3.10
v15.3.11
v15.3.2
v15.3.3
v15.3.4
v15.3.5
v15.3.6
v15.3.7
v15.3.8
v15.3.9
v7.*
v7.1.23
v7.1.24
v7.1.25
v7.1.26
v7.1.27
v7.2.0
v7.2.77
v7.2.78
v7.2.79
v7.2.80
v7.2.81
v7.3.0
v7.3.1
v7.3.2
v7.3.3
v7.3.8
v7.4.0
v7.4.2
v7.4.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23946.json"