Authorization Bypass in Frappe Helpdesk Affects User Ticket Creation

CVE-2026-111939

What is CVE-2026-111939?

An authorization bypass vulnerability has been identified in Frappe Helpdesk prior to version 1.26.0. This flaw allows authenticated users to create support tickets while impersonating other customers by manipulating the 'raised_by' value in their requests. An attacker can exploit this vulnerability by submitting a ticket request through the hd_ticket.api.new endpoint, providing a victim's email address. This could enable the attacker to generate fraudulent tickets and read responses intended for the victim, posing a risk of phishing and information leakage.

References