Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
"https://github.com/pypa/advisory-database/blob/main/vulns/tendenci/PYSEC-2020-112.yaml"