# CVE-2026-23946: PYSEC-2026-1950 - Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

Source: https://junglewise.ai/threats/cve-2026-23946-tendenci-helpdesk-authenticated-remote-code-execution-via-pickle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-23946 · Severity: low · CVSS 3.1 · Published 2026-07-07

Tendenci is an open-source web-based CMS and membership management platform with an optional Helpdesk module for managing support tickets. A flaw in the Helpdesk module allows staff-level users (ticket handlers) to execute arbitrary code on the server by exploiting unsafe deserialization of pickled Python objects. This represents a critical security gap since staff roles are commonly assigned to non-administrative ticket operators.

Technologies: [tendenci (PyPI)](https://junglewise.ai/threats/technologies/tendenci). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-23946 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23946 being exploited in the wild.

**How severe is CVE-2026-23946?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** tendenci (PyPI) ECOSYSTEM:introduced=0,fixed=15.3.12.

**Is there a fix for CVE-2026-23946?** Yes. tendenci (PyPI): upgrade to 15.3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23946 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-23946?** Check whether you run tendenci (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tendenci (PyPI): upgrade to 15.3.12 or later

  ```sh
  pip install "tendenci>=15.3.12"
  ```


## Technical details

A deserialization vulnerability exists in the Tendenci Helpdesk module's run_report() function in tendenci/apps/helpdesk/views/staff.py (line 1062), which unsafely uses pickle.loads() on user-supplied data. This is an incomplete patch of the earlier CVE-2020-14942, where ticket_list() was correctly fixed to use safe JSON deserialization, but run_report() was overlooked. An authenticated user with staff-level privileges (is_staff role) can craft malicious pickled objects and send them to the /helpdesk/reports/ endpoint to achieve remote code execution. The attack requires staff privileges and user interaction, and the damage is scoped to the permissions of the web server process (typically www-data), which generally lacks write and execute permissions beyond upload directories. Patch is available in version 15.3.12 and later.

## Affected products

- Tendenci Tendenci 15.3.11 and earlier

## Identifiers

- CVE-2026-23946
- GHSA-339m-4qw5-j2g3
- PYSEC-2026-1950

## Timeline

- 2026-01-21: disclosed: Vulnerability published via GitHub Security Advisory
- 2026-01-21: patched: Fix released in version 15.3.12

## References

- [https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3](https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3)

## Related threats

- [Tendenci CMS stored XSS in Jobs and Forums modules](https://junglewise.ai/threats/cve-2025-70959-tendenci-cms-stored-xss-in-jobs-and-forums-modules)
- [Tendenci CMS stored XSS in Forums and Jobs modules](https://junglewise.ai/threats/cve-2025-70960-tendenci-cms-stored-xss-in-forums-and-jobs-modules)
- [Tendenci CSV formula injection in contact form message field](https://junglewise.ai/threats/cve-2020-36962-tendenci-csv-formula-injection-in-contact-form-message-field)
- [PYSEC-2020-112 - Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.](https://junglewise.ai/threats/cve-2020-14942-deserialization-of-untrusted-data-in-tendenci)