Frappe Helpdesk versions earlier than 1.26.0 contain a flaw that lets an authenticated portal user supply a raised_by value that does not belong to them when creating a ticket via the hd_ticket.api.new endpoint. The bug permits the attacker to craft tickets that appear to come from another customer and to read responses to those tickets through the get_ticket_activities API, effectively bypassing normal authorization controls and enabling data exfiltration or social‑engineering attacks such as phishing.

This vulnerability affects the Frappe Helpdesk application bundled in all installations of helpdesk older than version 1.26.0. The issue was present in source code revisions around 1.25.1 and earlier and was closed in the 1.26.0 release.

The CVSS score of 5.1 indicates moderate severity. Exploitation requires that the attacker already is an authenticated portal user, so the attack vector is local to the web application. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, yet the combination of a moderate score, an in‑application endpoint available to authenticated users, and the ability to read other customers’ activity data points to a notable risk that warrants prompt mitigation.