CVE-2026-111939 in Helpdesk
Summary
by MITRE • 10/19/2026
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified security flaw resides within Frappe Helpdesk versions prior to 1.26.0, specifically affecting the authentication and authorization mechanisms governing ticket creation for authenticated portal users. This vulnerability constitutes a critical Authorization Bypass that undermines the fundamental principle of least privilege by allowing an attacker who has valid credentials for one user account to manipulate system state on behalf of another distinct user. The core technical deficiency lies in the insufficient validation of input parameters during the ticket initialization process, specifically regarding the raised_by field which identifies the originator of a support request. Instead of enforcing server-side verification that ensures the requesting authenticated session matches the identity specified in the payload, the application blindly accepts and persists the provided value without adequate cross-referencing against the current user's profile or permissions.
This architectural oversight enables an attacker to exploit the hd_ticket.api.new endpoint by injecting a victim's email address into the raised_by parameter during ticket creation requests. By doing so, the system registers new support tickets as if they were initiated directly by the targeted victim rather than the actual authenticated actor. This capability effectively allows for identity impersonation within the helpdesk context, creating a false audit trail that attributes malicious or deceptive actions to innocent third parties. The vulnerability is particularly insidious because it does not require privilege escalation in terms of administrative rights; standard portal user privileges are sufficient to execute this attack vector, making it accessible to any compromised low-level account.
The operational impact of this vulnerability extends beyond mere data integrity issues into the realm of social engineering and phishing campaigns. Once an attacker has successfully planted tickets impersonating a victim within that victim's own helpdesk interface, they gain access to read subsequent replies via the get_ticket_activities endpoint. This capability allows the adversary to monitor communications intended for the victim or to engage in deceptive interactions under the guise of the victim. In enterprise environments, this can be leveraged to disrupt customer support workflows, damage reputational trust by sending malicious content from a trusted identity, or facilitate further attacks such as credential harvesting if the impersonated tickets contain sensitive information requests. The ability to read replies also means that any confidential data shared with the helpdesk under the assumption of privacy relative to other users is exposed to the attacker controlling the initial account.
From a classification perspective, this vulnerability aligns closely with CWE-269 Improper Privilege Escalation and CWE-807 Reliance on Untrusted Inputs in Security-Critical Code. The failure to validate that the actor initiating an action matches the claimed identity of the action's subject is a classic example of broken access control logic. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1534 Internal Spearphishing, where attackers use internal systems and trusted identities to conduct phishing activities against other users within the same organization or platform ecosystem. The exploitation relies on the trust relationship between the helpdesk system and its user base, exploiting that trust to create confusion and potential security incidents among legitimate customers.
Mitigation strategies must prioritize immediate patching of the Frappe Helpdesk instance to version 1.26.0 or later, where this authorization bypass has been addressed through stricter input validation and server-side identity verification. For organizations unable to upgrade immediately due to compatibility constraints, compensating controls should be implemented at the network perimeter using Web Application Firewalls to monitor for anomalous patterns in ticket creation requests, such as rapid changes in the raised_by field or discrepancies between session cookies and submitted user identifiers. Additionally, implementing strict logging and alerting on helpdesk activities that deviate from normal behavioral baselines can aid in early detection of exploitation attempts. Security teams should also review existing audit logs to determine if any unauthorized tickets were created using this method prior to remediation, ensuring no ongoing phishing campaigns or data exfiltration are occurring through the compromised impersonated accounts.