Live › vulnerability › CVE-2026-111709
Go to dashboardWhaTicket Community through commit cf04795 does not check ticket ownership or queue when showing a ticket. An logged-in agent who supplies another agent's ticket id can read the full message history and send WhatsApp replies from that ticket.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running WhaTicket Community at or before commit cf04795 with multiple agents sharing one instance. A single-agent deployment has no other agents' tickets to reach, so the exposure is limited there.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
This page as .md · .json · in your agent: get_signal("CVE-2026-111709")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.