Is CVE-2026-111939 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111939?

CVE-2026-111939 has a CVSS v3 severity of MEDIUM (4.6).

Back

CVE-2026-111939

Description

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.