Is CVE-2026-23946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23946 being exploited in the wild.

How severe is CVE-2026-23946?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

tendenci (PyPI) ECOSYSTEM:introduced=0,fixed=15.3.12.

Is there a fix for CVE-2026-23946?

Yes. tendenci (PyPI): upgrade to 15.3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23946 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23946?

Check whether you run tendenci (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23946: PYSEC-2026-1950 - Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

CVE-2026-23946 · Severity: low · CVSS 3.1 · Published 2026-07-07

Tendenci is an open-source web-based CMS and membership management platform with an optional Helpdesk module for managing support tickets. A flaw in the Helpdesk module allows staff-level users (ticket handlers) to execute arbitrary code on the server by exploiting unsafe deserialization of pickled Python objects. This represents a critical security gap since staff roles are commonly assigned to non-administrative ticket operators.

Technologies: tendenci (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-23946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23946 being exploited in the wild.
How severe is CVE-2026-23946?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: tendenci (PyPI) ECOSYSTEM:introduced=0,fixed=15.3.12.
Is there a fix for CVE-2026-23946?: Yes. tendenci (PyPI): upgrade to 15.3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23946 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23946?: Check whether you run tendenci (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tendenci (PyPI): upgrade to 15.3.12 or later
```
pip install "tendenci>=15.3.12"
```

Technical details

A deserialization vulnerability exists in the Tendenci Helpdesk module's run_report() function in tendenci/apps/helpdesk/views/staff.py (line 1062), which unsafely uses pickle.loads() on user-supplied data. This is an incomplete patch of the earlier CVE-2020-14942, where ticket_list() was correctly fixed to use safe JSON deserialization, but run_report() was overlooked. An authenticated user with staff-level privileges (is_staff role) can craft malicious pickled objects and send them to the /helpdesk/reports/ endpoint to achieve remote code execution. The attack requires staff privileges and user interaction, and the damage is scoped to the permissions of the web server process (typically www-data), which generally lacks write and execute permissions beyond upload directories. Patch is available in version 15.3.12 and later.

Affected products

Tendenci Tendenci 15.3.11 and earlier

Identifiers

CVE-2026-23946
GHSA-339m-4qw5-j2g3
PYSEC-2026-1950

Timeline

2026-01-21: disclosed: Vulnerability published via GitHub Security Advisory
2026-01-21: patched: Fix released in version 15.3.12

References

https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.