WhaTicket Community IDOR lets agents read other agents' tickets
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
WhaTicket Community through commit cf04795 contains an insecure direct object reference that lets authenticated agents access tickets belonging to other agents. The ShowTicketService performs no ownership or queue checks, so an attacker can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId. This exposes full message history and allows posting WhatsApp replies (CWE-639).
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for WhaTicket Community.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111709
- 2026-10-16 Alias added: GHSA-hphf-v3fg-q5vg
- 2026-10-21 CISA SSVC decision points changed
- 2026-10-21 Priority changed: LOW → MEDIUM
References
Other 3
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/TicketServices/ShowTicketService.ts
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/MessageController.ts#L24-L58
- https://github.com/canove/whaticket-community
More canove vulnerabilities
- TI-2026-75494 Admin self-registration in WhaTicket Community via /auth/signup CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-111709 · CVE Program
- CVE-2026-111709 · NVD
- FIRST EPSS
- GHSA-hphf-v3fg-q5vg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences