Frappe Helpdesk CVE-2026-111939

Exploitation requires an authenticated low-privilege Frappe Helpdesk portal account (PR:L) and the ability to call the hd_ticket.api.new endpoint with an attacker-controlled raised_by parameter; the endpoint in versions before 1.26.0 trusts the client-supplied raised_by instead of binding it to frappe.session.user. Full impact (victim seeing the phishing ticket and the attacker reading replies) depends on passive victim interaction (UI:P) - the targeted customer must view/engage with the planted ticket in their portal. Limiting factors: valid portal credentials are needed (not fully unauthenticated), impact is confined to the specific victim's email/tickets, there is no availability or system-level impact, and instances already upgraded to v1.26.0 are not affected.

This is a moderate-severity authorization bypass (CWE-639, IDOR-style) with a vendor-assigned CVSS 4.0 base score of 5.1, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network reachability with low attack complexity but requires an authenticated portal account (PR:L) and passive victim interaction (UI:P) to realize the full impact, which correctly tempers the raw score. Impact is bounded to low confidentiality and low integrity (VC:L/VI:L, VA:N) - the attacker can plant tickets under a victim's identity and read their replies, but there is no availability impact, no privilege escalation, and no system compromise. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input; therefore exploitation status is 'no public exploit identified at time of analysis.' This is a legitimate but non-urgent fix-on-cycle issue, not an emergency: it is a logic/authorization flaw useful for targeted phishing and limited data exposure against specific customers rather than for mass or automated exploitation. The absence of EPSS/KEV/SSVC data means widespread-exploitation likelihood cannot be quantified from the input and would need external enrichment to confirm.

An attacker registers or already holds a low-privilege Frappe Helpdesk portal account, then calls the hd_ticket.api.new endpoint supplying a victim customer's email as the raised_by value, causing a ticket to appear in the victim's portal as if legitimately raised. The attacker uses this to plant a convincing phishing ticket and, via get_ticket_activities, reads the victim's replies. No public proof-of-concept was identified in the provided data, but the root cause and fix are confirmed by the vendor commit diff.