AIKIDO-2026-172712
django-helpdesk is vulnerable to ORM Injection
65
Medium Risk
This Affects:
django-helpdeskTL;DR
The ticket filtering and sorting endpoints in the staff views build Django ORM queries from user-supplied filter, null-filter, and sort keys without validating them. An authenticated staff user, or any authenticated user when non-staff ticket updates are enabled, can supply relation-traversal keys to reach columns in unrelated tables. The recordsFiltered count and the result ordering behaviour let sensitive values like password hashes and plaintext mailbox passwords to be reconstructed character by character. The fix enforces an allowlist on the filtering and sorting keys and falls back to a safe default ordering for invalid input.
Who does this affect?
You are affected if you run django-helpdesk before 2.3.2 and expose the staff ticket list, timeline, or dashboard views to authenticated staff users.
Background info
django-helpdesk is vulnerable to ORM Injection in versions 0.0.1 - 2.3.1.
How to fix this
Upgrade the django-helpdesk library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant