CVE-2026-23946 (GCVE-0-2026-23946)
Vulnerability from cvelistv5 – Published: 2026-01-22 00:09 – Updated: 2026-01-22 21:50
VLAI?
Title
Tendenci has Authenticated Remote Code Execution via Pickle Deserialization
Summary
Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.
Severity ?
6.8 (Medium)
CWE
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T21:50:36.997181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T21:50:51.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tendenci",
"vendor": "tendenci",
"versions": [
{
"status": "affected",
"version": "\u003c 15.3.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python\u0027s pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T00:09:24.205Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3"
},
{
"name": "https://github.com/tendenci/tendenci/issues/867",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/issues/867"
},
{
"name": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1"
},
{
"name": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636"
},
{
"name": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e"
},
{
"name": "https://docs.python.org/3/library/pickle.html#restricting-globals",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.python.org/3/library/pickle.html#restricting-globals"
},
{
"name": "https://github.com/advisories/GHSA-jqmc-fxxp-r589",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/advisories/GHSA-jqmc-fxxp-r589"
},
{
"name": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tendenci/tendenci/releases/tag/v15.3.12"
}
],
"source": {
"advisory": "GHSA-339m-4qw5-j2g3",
"discovery": "UNKNOWN"
},
"title": "Tendenci has Authenticated Remote Code Execution via Pickle Deserialization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23946",
"datePublished": "2026-01-22T00:09:24.205Z",
"dateReserved": "2026-01-19T14:49:06.311Z",
"dateUpdated": "2026-01-22T21:50:51.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-23946\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-22T01:15:52.467\",\"lastModified\":\"2026-01-22T01:15:52.467\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python\u0027s pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"},{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"references\":[{\"url\":\"https://docs.python.org/3/library/pickle.html#restricting-globals\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/advisories/GHSA-jqmc-fxxp-r589\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/tendenci/tendenci/issues/867\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/tendenci/tendenci/releases/tag/v15.3.12\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3\",\"source\":\"security-advisories@github.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23946\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-22T21:50:36.997181Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-22T21:50:46.968Z\"}}], \"cna\": {\"title\": \"Tendenci has Authenticated Remote Code Execution via Pickle Deserialization\", \"source\": {\"advisory\": \"GHSA-339m-4qw5-j2g3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"tendenci\", \"product\": \"tendenci\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 15.3.12\"}]}], \"references\": [{\"url\": \"https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3\", \"name\": \"https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/tendenci/tendenci/issues/867\", \"name\": \"https://github.com/tendenci/tendenci/issues/867\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1\", \"name\": \"https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636\", \"name\": \"https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e\", \"name\": \"https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://docs.python.org/3/library/pickle.html#restricting-globals\", \"name\": \"https://docs.python.org/3/library/pickle.html#restricting-globals\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/advisories/GHSA-jqmc-fxxp-r589\", \"name\": \"https://github.com/advisories/GHSA-jqmc-fxxp-r589\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tendenci/tendenci/releases/tag/v15.3.12\", \"name\": \"https://github.com/tendenci/tendenci/releases/tag/v15.3.12\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python\u0027s pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-22T00:09:24.205Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-23946\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-22T21:50:51.715Z\", \"dateReserved\": \"2026-01-19T14:49:06.311Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-22T00:09:24.205Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…