---
id: "CVE-2026-111709"
kind: "vulnerability"
aliases: ["CVE-2026-111709"]
title: "WhaTicket Community: authenticated agents can read other agents' tickets"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "whaticket", "whatsapp"]
not_affected_if: ["auth-required", "single-agent-use"]
published_at: "2026-10-16T18:17:55+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:18:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111709", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# WhaTicket Community: authenticated agents can read other agents' tickets

WhaTicket Community through commit cf04795 does not check ticket ownership or queue when showing a ticket. An logged-in agent who supplies another agent's ticket id can read the full message history and send WhatsApp replies from that ticket.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111709

## From the sources

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_