6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23946

CVE-2026-23946: Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23946

CVE-2026-23946:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tendenci	pip	< 15.3.12	15.3.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commits confirms that the vulnerability is a result of an incomplete patch for CVE-2020-14942. The commit 63e1b84a5b163466d1d8d811d35e7021a7ca0d0e explicitly replaces the unsafe pickle.loads() with simplejson.loads() in the run_report function within tendenci/apps/helpdesk/views/staff.py. This is the smoking gun, as pickle.loads() on untrusted data is the root cause of the remote code execution vulnerability.

Additionally, commit 23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1 shows hardening of the save_query function, which is responsible for saving the queries that are later processed by run_report. This change introduces form validation to ensure that the saved query is valid JSON, thus preventing a malicious pickled object from being stored and later executed. While run_report is the function where the code execution occurs, save_query is the function that allows the malicious payload to be introduced. Therefore, both are relevant to the vulnerability.

Vulnerable functions

run_report

tendenci/apps/helpdesk/views/staff.py

The 'run_report' function was vulnerable to remote code execution because it used 'pickle.loads()' to deserialize a 'saved_query' object. An authenticated attacker with staff privileges could craft a malicious query that, when processed by this function, would execute arbitrary code. The vulnerability was an incomplete patch for a previous deserialization flaw (CVE-2020-14942).

save_query

tendenci/apps/helpdesk/views/staff.py

The 'save_query' function was modified to validate user-supplied data before saving it. Previously, it directly saved the 'query_encoded' parameter from the POST request. The fix introduced 'SavedSearchForm' to validate the query using 'simplejson.loads', preventing malicious pickled strings from being saved in the first place. While the RCE is triggered in 'run_report', this function was the entry point for the malicious data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.