Three authorisation holes in one helpdesk stack: what CVE-2026-111937, CVE-2026-111938 and CVE-2026-111939 have in common

Three Frappe advisories share one failure: an object identifier supplied by the caller is treated as a fact instead of a claim. Includes verification steps for each pattern.