Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
tendenci tendenci 12.0.10