CVE-2026-111709
WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 21, 2026
- Reserved
- Oct 16, 2026
Description
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
whaticket-communitycanove |
|
References
- https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idorthird-party-advisory
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/TicketServices/ShowTicketService.tstechnical-description
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/MessageController.ts#L24-L58technical-description
- https://github.com/canove/whaticket-communityproduct
- VulnCheck Advisory: WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketIdthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.