CVE-2026-111709

MEDIUM 5.4

WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

CWE	CWE-639
Vendor	canove
Product	whaticket-community
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for canove whaticket-community

Be the first to know when new medium vulnerabilities affecting canove whaticket-community are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

canove / whaticket-community

0 ≤ cf047955a6f0d07002ed89c67d765c28d06f8d52

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor github.com: https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/TicketServices/ShowTicketService.ts github.com: https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/MessageController.ts#L24-L58 github.com: https://github.com/canove/whaticket-community vulncheck.com: https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-idor-via-tickets-ticketid-and-messages-ticketid

Credits

hieuPenguinnn