CVE-2026-23946 - Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

Back Back to CVE browser

MEDIUM

Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

Published Jan 22, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.85%

Description

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.

Affected products

Vendor Tendenci Product Tendenci Default
n/a
- Version
  < 15.3.12
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tendenci

n/a

Version	Status	Constraints
< 15.3.12	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-502

Deserialization of Untrusted Data

CWE-94

Code Injection

References (12)

https://docs.python.org/3/library/pickle.html#restricting-globals
x_refsource_MISCNot Applicable
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3670
Advisory
https://github.com/advisories/GHSA-339m-4qw5-j2g3
Advisory
https://github.com/advisories/GHSA-jqmc-fxxp-r589
x_refsource_MISCNot Applicable
https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1
x_refsource_MISCPatch
https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636
x_refsource_MISCPatch
https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e
x_refsource_MISCPatch
https://github.com/tendenci/tendenci/issues/867
x_refsource_MISCExploitIssue TrackingPatchVendor Advisory
https://github.com/tendenci/tendenci/releases/tag/v15.3.12
x_refsource_MISCRelease Notes
https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3
x_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-14942
https://nvd.nist.gov/vuln/detail/CVE-2026-23946

Link	Providers	Tags
https://docs.python.org/3/library/pickle.html#restricting-globals		x_refsource_MISCNot Applicable
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3670		Advisory
https://github.com/advisories/GHSA-339m-4qw5-j2g3		Advisory
https://github.com/advisories/GHSA-jqmc-fxxp-r589		x_refsource_MISCNot Applicable
https://github.com/tendenci/tendenci/commit/23d9fd85ab7654e9c83cfc86cb4175c0bd7a77f1		x_refsource_MISCPatch
https://github.com/tendenci/tendenci/commit/2ff0a457614944a1b417081c543ea4c5bb95d636		x_refsource_MISCPatch
https://github.com/tendenci/tendenci/commit/63e1b84a5b163466d1d8d811d35e7021a7ca0d0e		x_refsource_MISCPatch
https://github.com/tendenci/tendenci/issues/867		x_refsource_MISCExploitIssue TrackingPatchVendor Advisory
https://github.com/tendenci/tendenci/releases/tag/v15.3.12		x_refsource_MISCRelease Notes
https://github.com/tendenci/tendenci/security/advisories/GHSA-339m-4qw5-j2g3		x_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-14942
https://nvd.nist.gov/vuln/detail/CVE-2026-23946