CVE-2026-23946: Tendenci is an open source content management system built for non-profits, associations and cause-based sites

Q: How do I fix CVE-2026-23946?

tendenci: upgrade to 15.3.12. Exact commands for each OS are on this page.

Q: Is CVE-2026-23946 being exploited?

CVE-2026-23946 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-23946 affect?

CVE-2026-23946 affects tendenci. Severity is medium (CVSS 6.8). Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by defa

Q: How urgent is CVE-2026-23946?

Priority 43/100. Public exploit reference

This month

MEDIUM 6.8UPGRADE

CVE-2026-23946 is a medium-severity flaw (CVSS 6.8) affecting tendenci. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incomple

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	6.8 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	High
User interaction	Required
EPSS exploit chance	0.8% (top 42%)
CISA exploited list	No
Weakness	CWE-94, CWE-502
Published	2026-01-22
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: tendenci

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-01-22 01:15 UTCPublished CVE record published
2026-06-17 10:22 UTCUpdated Record last modified

tendenci tendenci UPGRADE

Affected: < 15.3.12

Fixed in: 15.3.12

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy tendenci || rpm -q tendenci || tendenci --version

2. UPGRADE to 15.3.12 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade tendenci

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade tendenci

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-23946?

tendenci: upgrade to 15.3.12. Exact commands for each OS are on this page.

Is CVE-2026-23946 being exploited?

CVE-2026-23946 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-23946 affect?

CVE-2026-23946 affects tendenci. Severity is medium (CVSS 6.8). Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by defa

How urgent is CVE-2026-23946?

Priority 43/100. Public exploit reference

Software pages

Python vulnerabilities

Related CVEs

CVE-2020-36962 CRITICAL 9.8 DOWNGRADE Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows a
CVE-2025-70960 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attacker
CVE-2025-70959 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers

References

← Back to latest CVEs