CVE-2026-111709

MediumCVSS 5.4

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Summary

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

Risk Assessment

Agents can unauthorizedly view and reply to other agents' tickets, breaching customer data confidentiality and potentially leading to information leakage. This may also allow sending unauthorized messages on behalf of the company.

Recommendation

Update WhaTicket Community to a version containing the fix or apply a patch on commit cf04795. Until then, consider implementing additional application-level access controls.

Other vulnerabilities in WhaTicket Community

CVE-2026-111708Critical
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS