Medium severity · published Oct 16, 2026
CVE-2026-111709
WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
whaticket-community · canove
through cf047955a6f0d07002ed89c67d765c28d06f8d52 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111709
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111709
github.com
https://github.com/canove/whaticket-community
github.com
https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/MessageController.ts#L24-L58
github.com
https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/TicketServices/ShowTicketService.ts
hackmd.io
https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor
www.vulncheck.com
https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-idor-via-tickets-ticketid-and-messages-ticketid
More from whaticket-community
9.8
CVE-2026-111708
WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup