AIKIDO-2026-172712

TL;DR

The ticket filtering and sorting endpoints in the staff views build Django ORM queries from user-supplied filter, null-filter, and sort keys without validating them. An authenticated staff user, or any authenticated user when non-staff ticket updates are enabled, can supply relation-traversal keys to reach columns in unrelated tables. The recordsFiltered count and the result ordering behaviour let sensitive values like password hashes and plaintext mailbox passwords to be reconstructed character by character. The fix enforces an allowlist on the filtering and sorting keys and falls back to a safe default ordering for invalid input.