Frappe Helpdesk vulnerabilities

2 vulnerabilities

Known vulnerabilities in Frappe Helpdesk, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.1CVE-2026-111939frappehelpdesk
EPSS score
0.22%
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.8.8CVE-2025-10655frappefrappe helpdesk+1
EPSS score
0.56%
SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.