CVE-2026-23946
Tendenci has Authenticated Remote Code Execution via Pickle Deserialization
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.
Timeline
ID reserved
By GitHub_M
- 3 days later
· 3 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Medium6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.84% · top 42% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPItendenciGHSA-339m-4qw5-j2g3 (opens in a new tab)
References (8)
- https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/tendenci/tendenci/issues/867 (opens in a new tab)x_refsource_MISC
- https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1 (opens in a new tab)x_refsource_MISC
- https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636 (opens in a new tab)x_refsource_MISC
- https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e (opens in a new tab)x_refsource_MISC
- https://docs.python.org/3/library/pickle.html#restricting-globals (opens in a new tab)x_refsource_MISC
- https://github.com/advisories/GHSA-jqmc-fxxp-r589 (opens in a new tab)x_refsource_MISC
- https://github.com/tendenci/tendenci/releases/tag/v15.3.12 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-339m-4qw5-j2g3 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-23946)Record last updated .